Re: [E2ee] Does the presence of overt, "Non-Ghost" surveillance actors/bots, inhibit E2E Security?

[Alec Muffett <[e-mail]>]

Hi Vittorio - nice to talk to you again!

On Thu, 29 Jul 2021 at 10:54, Vittorio Bertola <
[e-mail]> wrote:
>
> I think that you are mixing three separate concepts:
> 1) end-to-end encryption, which is a technical property of a
communication system;
> 2) end-to-end security, which is a somewhat abstract concept possibly
including other factors than just the communication system;
> 3) an appropriate disclosure policy for lawful interception, which is
interesting but possibly out of scope for the IETF, and more in scope for
law-making venues.

Yes,  I am.  I feel that it is proper and appropriate, given that I am also
placing bounds upon how they are being discussed.


> By the way, the apps you mention (Whatsapp and Signal) do not provide
"end-to-end encryption" but "managed end-to-end encryption" [deletia]

I will let you argue definitions of end-to-end encryption with the people
authoring the relevant draft for that term; my work is focused narrowly
upon "end-to-end secure messaging".

> Of course, managed e2ee is much easier to use while still providing a
good degree of protection, but it requires you to trust the provider of the
communication system, and there are clear reasons why people who really
need absolute protection from any kind of screening should not rely on it;

Absolutely - the exercise of user choice to import (say) Signal into one's
Trusted Compute Base, is a huge and somewhat blind leap of
(reputation-based?) trust.


> In terms of #3, I'm not sure if it's on topic, but I will note that by
definition lawful interception happens according to a law, so the fact that
it exists is public. What you as a user do not generally know is if it has
been turned on on your account, but there are reasons for that, and also -
in democratic countries - appropriate guarantees. Nothing would anyway
prevent the app from reminding that, in some cases, your communications
could be reported according to a law or court order.

Exactly so, per slide 25 at
https://alecmuffett.com/alecm/ietf-111/draft-muffett-e2esm-v1.18a.pdf
perhaps something like:

> Messages you send to this chat and calls are now secured with end-to-end
encryption, but may be subject to interception or review by ourselves, and
law enforcement, safety communities, and outsourced agents from the
following national governments that we have determined from your profile
information: [...]

 ...might be appropriate for people who live in, or cross-, jurisdictions
that do not permit them to communicate privately.  You know,
totalitarian states.  That sort of thing.

    -a
--
https://alecmuffett.com/about