this post was submitted on 04 Dec 2024
623 points (99.4% liked)

Technology

60048 readers
2770 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
[–] mosiacmango@lemm.ee 34 points 2 weeks ago (52 children)

End to end is end to end. Its either "the devices sign the messages with keys that never leave the the device so no 3rd party can ever compromise them" or it's not.

Signal is a more trustworthy org, but google isn't going to fuck around with this service to make money. They make their money off you by keeping you in the google ecosystem and data harvesting elsewhere.

[–] EvilBit@lemmy.world 51 points 2 weeks ago* (last edited 2 weeks ago) (19 children)

google isn't going to fuck around with this service to make money

Your honor, I would like to submit Exhibit A, Google Chrome “Enhanced Privacy”.

https://www.eff.org/deeplinks/2023/09/how-turn-googles-privacy-sandbox-ad-tracking-and-why-you-should

Google will absolutely fuck with anything that makes them money.

[–] mosiacmango@lemm.ee -1 points 2 weeks ago* (last edited 2 weeks ago) (16 children)

Thats a different tech. End to end is cut and dry how it works. If you do anything to data mine it, it's not end to end anymore.

Only the users involved in end to end can access the data in that chat. Everyone else sees encrypted data, i.e noise. If there are any backdoors or any methods to pull data out, you can't bill it as end to end.

[–] micballin@lemmy.world 9 points 2 weeks ago (3 children)

They can just claim archived or deleted messages don't qualify for end to end encryption in their privacy policy or something equally vague. If they invent their own program they can invent the loophole on how the data is processed

[–] cheesemoo@lemmy.world 11 points 2 weeks ago (2 children)

Or the content is encrypted, but the metadata isn't, so they can market to you based on who you talk to and what they buy, etc.

[–] mosiacmango@lemm.ee 2 points 2 weeks ago (1 children)

This part is likely, but not what we are talking about. Who you know and how you interact with them is separate from the fact that the content of the messages is not decryptable by anyone but the participants, by design. There is no "quasi" end to end. Its an either/or situation.

It doesn't matter if the content is encrypted in transit if Google can access the content in the app after decryption. That doesn't violate E2EE, and they could easily exfiltrate the data though Google Play Services, which is a hard requirement.

I don't trust them until the app is FOSS, doesn't rely on Google Play Services, and is independently verified to not send data or metadata to their servers. Until then, I won't use it.

[–] rottingleaf@lemmy.world 1 points 2 weeks ago

Provided they have an open API and don't ban alternative clients, one can make something kinda similar to TOR in this system, taking from the service provider the identities and channels between them.

Meaning messages routed through a few hops over different users.

Sadly for all these services to have open APIs, there needs to be force applied. And you can't force someone far stronger than you and with the state on their side.

[–] mosiacmango@lemm.ee 1 points 2 weeks ago* (last edited 2 weeks ago)

The messages are signed by cryptographic keys on the users phones that never leave the device. They are not decryptable in any way by google or anyone else. Thats the very nature of E2EE.

How end-to-end encryption works

When you use the Google Messages app to send end-to-end encrypted messages, all chats, including their text and any files or media, are encrypted as the data travels between devices. Encryption converts data into scrambled text. The unreadable text can only be decoded with a secret key.

The secret key is a number that’s:

Created on your device and the device you message. It exists only on these two devices.

Not shared with Google, anyone else, or other devices.

Generated again for each message.

Deleted from the sender's device when the encrypted message is created, and deleted from the receiver's device when the message is decrypted.

Neither Google or other third parties can read end-to-end encrypted messages because they don’t have the key.

They cant fuck with it, at all, by design. That's the whole point. Even if they created "archived" messages to datamine, all they would have is the noise.

[–] circuitfarmer@lemmy.sdf.org 0 points 2 weeks ago

Exactly. We know corporations regularly use marketing and doublespeak to avoid the fact that they operate for their interests and their interests alone. Again, the interests of corporations are not altruistic, regardless of the imahe they may want to support.

Why should we trust them to "innovate" without independent audit?

load more comments (12 replies)
load more comments (14 replies)
load more comments (46 replies)