upvote

points

by m348e9129 hours ago |
comments
upvoteby sillywabbit9 hours ago|
next
[-]
End-to-end encryption only means something if you trust the endpoints.
reply
upvoteby rvnx9 hours ago|
parent|
[-]
They often also tend to call HTTPS end-to-end encryption

https://aws.amazon.com/blogs/media/securing-your-origin-for-...

even Amazon Web Services:

    Benefits of using HTTPS connections:
    HTTPS provides end-to-end encryption
reply
upvoteby sillywabbit8 hours ago|
parent|
[-]
I wonder if that's why it's called Transport Layer Security.
reply
upvoteby ivan_gammel9 hours ago|
prev|
next
[-]
When national interests require that, it can get a firmware update which sends a copy of data to comrades in U.S. Ministerium für Staatssicherheit even before that e2e encrypted copy reaches your phone.
reply
upvoteby 8 hours ago|
parent|
[-]
deleted
reply
upvoteby drnick13 hours ago|
prev|
next
[-]
Who has the keys of the encryption algorithm?
reply
upvoteby SV_BubbleTime8 hours ago|
prev|
[-]
>enable end-to-end encryption between the camera and your phone.

So… exactly not the part I care about?

Cool, it’s encrypted on transit to me… now what about at rest with them? Is it encrypted and they absolutely can not view or hand that footage to police/gov? No.

reply
upvoteby m348e9128 hours ago|
parent|
[-]
> Cool, it’s encrypted on transit to me… now what about at rest with them? Is it encrypted and they absolutely can not view or hand that footage to police/gov? No.

Technically yes, e2e encryption means video hosted on their servers is only viewable by devices with decryption keys. So if the police/gov brought a subpoena to request the video, Ring could only offer them the encrypted video. They would have to take possession of your phone and gain access in order to decrypt and view the video.

In this case the "ends" in the e2e encryption is the camera and your phone.

reply
upvoteby Galanwe5 hours ago|
parent|
next
[-]
I used to work for a well known communication app, the kind everyone here used. Couple things I learnt about "end to end encryption":

- You can call your service e2e encrypted even if every client has the same key bundled into the binary, and rotate it from time to time when it's reversed.

- You can call your service e2e encrypted even if you have a server that stores and pushes client keys. That is how you could access your message history on multiple devices.

- You can call your service e2e encrypted and just retrieve or push client keys at will whenever you get a government request.

reply
upvoteby SV_BubbleTime4 hours ago|
parent|
prev|
[-]
We already 100% know this is misleading though. Amazon has access to your ring footage.

They are acknowledging that the end to end TRANSIT is encrypted. They are not encrypting from themselves at rest.

reply