A 10-month Commerce Department probe concluded Meta could view all WhatsApp messages in unencrypted form

  • theunknownmuncher@lemmy.world
    link
    fedilink
    English
    arrow-up
    61
    arrow-down
    1
    ·
    1 day ago

    The most important question to ask when evaluating end-to-end encryption: who manages the keys?

    If Facebook manages all of the keys and is responsible for telling which public key belongs to who, then of course Facebook can read every message.

    • lemonhead2@lemmy.world
      link
      fedilink
      English
      arrow-up
      37
      ·
      edit-2
      1 day ago

      oh lol. the trust chain is harder and harder to verify these days. i miss the good old days where I would write emails in vi and encrypt with gpg.

      I still write emails with vi. but I lost touch with the one other friend I had who knew how to use gpg 😂😂😂

        • Flagstaff@programming.dev
          link
          fedilink
          English
          arrow-up
          1
          ·
          22 hours ago

          Is there an ELI5, foolproof, step-by-step tutorial? I tried Kleopatra on my own and was so completely befuddled; why is that, like, literally the only app out there in the whole world for PGP or GPG or whatever? Shouldn’t there be dozens of such encoders?

          • somenonewho@feddit.org
            link
            fedilink
            English
            arrow-up
            1
            ·
            16 hours ago

            It heavily depends in your usecase but if you want to use gpg to encrypt emails and dont want to do it all in the terminal i really recommend using Thunderbird it integrates gpg very well and makes it mostly seamless.

            Other than that afaik Kleopatra is the only standalone GUI for gpg simply because most of the time gpg is integrated in workflows (simply using the cli interface vor gpg libraries) and plain gpg for simple tex/file encryption/signing is just not a usecase.many people have

    • qprimed@lemmy.ml
      link
      fedilink
      English
      arrow-up
      8
      ·
      1 day ago

      even better - as far as I am aware the client isn’t open (and even if it were, is your installed build from the same source?).

      so, even if the keys are local only, who says there isn’t a hidden API that simply sends locally decrypted content back to a remotely calling endpoint?

      • logi@piefed.world
        link
        fedilink
        English
        arrow-up
        6
        ·
        1 day ago

        That, and if WhatsApp has the keys, then no amount of encryption is going to help.

        If I remember, the allegation was that they did keep all the keys and many employees could request them to decrypt specific sessions.