zlacker

The coming war on end-to-end encryption

submitted by EGreg+(OP) on 2023-04-21 17:00:12 | 145 points 50 comments
[view article] [source] [go to bottom]

NOTE: showing posts with links only show all posts
1. cracke+J5[view] [source] 2023-04-21 17:21:24
>>EGreg+(OP)
Nice! I worked on something that seems similar to this (https://redact.ws). Unfortunately there are a lot of challenges with adoption that seem difficult to overcome. One of the big challenges is that most people do not understand the nuances of privacy and encryption, and they aren't willing to jump through hoops to protect their data.
3. EGreg+Wa[view] [source] 2023-04-21 17:43:40
>>EGreg+(OP)
If anyone is wondering what a solution can look like, which can strike a balance between privacy and social good, the end of the article links to another one: https://community.qbix.com/t/balancing-privacy-and-accountab...
◧◩
6. EGreg+ic[view] [source] [discussion] 2023-04-21 17:49:37
>>WorldP+ta
That’s an interesting point. I’m the chief architect of the company so I can speak to this, and happy to discuss / explore alternatives. But keep in mind we don’t have deep pockets, it took me 10 years of scraping by and paying my developers who have their families to support, just to get this far! (If you like mwhat we do and you’re thinking of supporting us with $100 or more, feel free here: https://wefunder.com/Qbix)

Wordpress powers 40% of all websites in the world. It’s written in PHP. Facebook has chosen PHP as well and has helped PHP to new heights of performance. PHP 8 with Swoole or simply AmPHP now outperforms Node.js for instance, in terms of efficiency. But plain old PHP code through php-fpm with enough instances can approach 50% of that with no custom coding.

PHP is the most widely deployed runtime for Web2 hosting, and EVM is the most widely deployed runtime for Web3 smart contracts. We always strived to target the most widely supported platforms, so people could find many hosts, or set up their own easily.

We will be carefully building out https://qbix.com/ecosystem to support hosting in a variety of environments, including with poor and nonexistent internet on commodity computers and wifi mesh networks. We work with groups that range from the Rohingya Project to the Forward Party. We often need high-speed low-latency multimedia to be available locally, eg for educational purposes or planning a dinner.

So why not go with a rock-solid, tried and true platform, and maintain backward compatibility? We purposely avoid even the latest ECMAScript or PHP 8 syntax, to make sure that Qbix can run anywhere, same as Wordpress.

PS: Just like Discourse (another open source project we have integrated with and whose community we are friends with) our entire platform can be used as a headless REST API, so nothing is stopping you from building a front end for it in Flutter or React Native or the newest kid on the block: MAUI from Microsoft. We bet the company on HTML like Zuckerberg did in 2014 and we stuck with it. You don’t need to even install an app these days — just go to a site like https://intercoin.app or https://yang2020.app and use it. Put it on your home screen to get notifications in iOS 16. Use a ContactPicker to invite friends privately. Having said that, we do support Cordova natively out of the box. Sometimes the old ways are best :)

◧◩
11. EGreg+Oe[view] [source] [discussion] 2023-04-21 18:01:00
>>Karell+6d
Well, HTTPS is not end-to-end. That latter term is reserved for encryption that encrypts the messages between clients so servers can’t parse them.

When you have a centralized system like ICANN DNS, the governments know which IP addresses the domain points to. They can go and serve them National Security Letters or shake them down to install secret backdoors.

WhatsApp and Facebook can lie to you that they’re end-to-end encrypted. There is nothing stopping them from shipping custom updates. In facg they’ve been caught red-handed spying on both your video and audio. The only way you can be SURE an app isnt lying to you is with open source software, then you only have to trust the OS and browser (the Trusted Computing Base).

(That is why I am a big fan of blockchain-based smart contaracts. But blockchains are slow, so the next best thing is hosting your business logic using open source software on servers you control.)

Why do so many people trust Big Tech? Simple. We have no other choice!

Where are the VIABLE AND USER FRIENDLY open source alternatives to Facebook, Twitter, Telegram backends?

No one seems to have built anything better or more efficient than, say, Mastodon.

Except us. It was a labor of love and cost me a million dollars to date: https://github.com/Qbix/Platform

PS: If you play with it for a afternoon, post your experience or email me. I would be thrilled to hear about your experience, good or bad. And of course use it for anything you want.

I would be very happy to be proven wrong and see some more competitors being mentioned here, but if you do, make an honest assessment of how they compare! People need alternatives to the closed walled gardens, but having all these features working and up-to-date with browser tech is extremely hard: https://qbix.com/features.pdf

14. EGreg+Xg[view] [source] 2023-04-21 18:11:28
>>EGreg+(OP)
Author here. Happy to see this went viral.

I have spent 12 years and 1 million dollars to date (no exaggeration, I worked jobs, architected trained / paid my developer team for years, we are now good friends) on a project to hopefully help people get a viable alternative to the Big Tech, and have choice where to host the infrastructure they typically expect from Facebook, Twitter, Telegram etc. It’s open source and it’s the only way you can make it expensive to backdoor everyone in bulk, or shut down a platform altogether:

https://github.com/Qbix/Platform

If you spend an afternoon playing with, I think you’ll feel like you’re discovering superpowers (like Batman or Iron man or something). It’s free to use. We’re launching https://qbix.com/ecosystem soon, with courses and certification so anyone who wants to learn, click on my profile and email me.

Here is the philosophy behind why we built it: https://qbix.com/blog/2021/01/15/open-source-communities/

And if you like what we do and you’re thinking of supporting us with $100 or more, feel free to do it here… November 5 we are launching, until then you can voluntarily put a “no-obligation” contribution: https://wefunder.com/Qbix

16. lisper+wh[view] [source] 2023-04-21 18:14:12
>>EGreg+(OP)
Eight years ago I took a whack at building a fully open source end-to-end encryption system. This is what I came up with at the time:

https://github.com/Spark-Innovations/SC4

It's a bit dated at this point. It doesn't have a ratchet. I did implement one, but never got around to integrating it:

https://github.com/rongarret/ratchet-js

I also had an MVP iOS app which was never launched.

The reason I gave up on the project was that no one seemed to be interested. I spent several years looking for customers and collaborators and basically found nothing. The conclusion I came to is that a lot of people complain about the impending end of E2EE but very few people are actually willing to do anything about it except whine.

◧◩◪◨
27. EGreg+Gs[view] [source] [discussion] 2023-04-21 19:04:30
>>hammyh+2l
I’d like to say it was all part of a secret plan to not draw attention to ourselves until we were ready. But it wasn’t.

The sad truth is, we were always low on money and bootstrapping. We spent a lot of time building, and very little time pitching.

We pitched about 10 VCs total in this whole time. I remember being at an event where Reid Hoffman spoke, he said he pitched 99 VCs before he got investment.

But we spent zero on marketing and PR, and 11 million people in 100 countries downloaded our Groups app. But the app is not that interesting, people don’t understand that most of our users are community leaders.

What people don’t get is that in this space, you need ALL THE FEATURES that Big Tech platforms offer before people will switch. It simply took us 10-12 years to get to this point. I picked a hard problem, but a very rewarding one in the end.

Look, MySQL and NGinX took 10 years before VCs funded them. But to be fair, they grew a lot whereas Qbix didn’t. Maybe I and my team simply suck at making things viral. But I believe this year will change that.

Networking is hard. I’m a guy who came from an immigrant family in Brooklyn. I never moved to the West Coast. We applied to HN with Qbix every other year since 2011. Never even got invited to the interview.

Now, I personally know Noam Chomsky, Tulsi Gabbard, Andrew Yang, Tim Berners-Les (see the photo at https://wefunder.com/Qbix), the Rohingya Project guys, Queen Diambi of a tribe in the Congo, the hed of United Nations Capital Development Fund, the head of CoinDesk, and many more randomly assorted people I met over the years. But it took years.

And I still don’t know very good VCs. And many VCs still look at our open source project as ”too big”. They prefer to invest in small feature companies, which we can now spin off from our accelerator.

If you want to introduce me, I’m very happy to take a meeting and demo on Zoom.

And if you want to support it, just go to https://wefunder.com/Qbix and kick in $100 or something. We are gearing up launch the 5th of November this year — and you’ll definitely not forget that :)

◧◩◪◨⬒⬓
33. nomel+iv[view] [source] [discussion] 2023-04-21 19:17:54
>>Karell+mj
I've found our problem. It appears the meaning has (apparently?) changed around 2014. Many search results you can find, including from IBM, and EFF, use the "old" (our) definition.

See: https://en.wikipedia.org/wiki/End-to-end_encryption#Etymolog...

> The term "end-to-end encryption" originally only meant that the communication is never decrypted during its transport from the sender to the receiver.

> ...

> Later, around 2014, the meaning of "end-to-end encryption" started to evolve when WhatsApp encrypted a portion of its network. ...

But, I don't have confidence that the policy makers will make this distinction.

45. musica+pt1[view] [source] 2023-04-22 01:20:35
>>EGreg+(OP)
How is this coming war on e2e encryption different from similar wars since the 1990s? [1,2]

[1] "Doomed to repeat history? Lessons from the Crypto Wars of the 1990s", https://www.jstor.org/stable/resrep10502

[2] https://en.wikipedia.org/wiki/Crypto_Wars

◧◩
48. yencab+104[view] [source] [discussion] 2023-04-23 00:11:41
>>UpToTh+0c
> Regarding end-2-end encryption: It does not prevent a government from reading your messages anyhow. They could instruct Meta (or whichever company is in control of the app you use) to send them the the messages you write directly from your phone. Or from the phone of the receiver. Or to send them the private key from your phone. They could also ask Apple or Google to do so, since those have acceess to everything on your phone.

There is a huge difference between "use the encryption key you already have to decrypt this message" and "implement changes in your software that allow attacking this person".

Last I heard, US courts couldn't force companies into doing anything, only to reveal information, or to mandate secrecy. The idea of a warrant canary is 100% based on the idea that the government cannot force the company to publish a statement it does not wish to publish.

https://en.wikipedia.org/wiki/Warrant_canary

◧◩◪◨⬒⬓
49. cracke+RD9[view] [source] [discussion] 2023-04-24 21:50:51
>>pcthro+3l1
Exactly. This section on the website should explain it with some more detail: https://redact.ws/how-it-works#client
[go to top]