Showerthoughts

42893 readers

275 users here now

A "Showerthought" is a simple term used to describe the thoughts that pop into your head while you're doing everyday things like taking a shower, driving, or just daydreaming. The most popular seem to be lighthearted clever little truths, hidden in daily life.

Here are some examples to inspire your own showerthoughts:

Rules

All posts must be showerthoughts
The entire showerthought must be in the title
No politics
- If your topic is in a grey area, please phrase it to emphasize the fascinating aspects, not the dramatic aspects. You can do this by avoiding overly politicized terms such as "capitalism" and "communism". If you must make comparisons, you can say something is different without saying something is better/worse.
- A good place for politics is c/politicaldiscussion
Posts must be original/unique
Adhere to Lemmy's Code of Conduct and the TOS

If you made it this far, showerthoughts is accepting new mods. This community is generally tame so its not a lot of work, but having a few more mods would help reports get addressed a little sooner.

Whats it like to be a mod? Reports just show up as messages in your Lemmy inbox, and if a different mod has already addressed the report, the message goes away and you never worry about it.

founded 3 years ago

MODERATORS

vatlark@lemmy.world

forkball@lemmy.world

SuperEars@lemmy.world

thoughts about end-to-end encryption (feddit.org)

submitted 1 week ago* (last edited 1 week ago) by gandalf_der_12te@feddit.org to c/showerthoughts@lemmy.world

13 comments fedilink hide all child comments

you know matrix chat? it's supposed to be end-to-end encrypted. the same goes for whatsapp and other chat applications.

(technical note: if alice wants to send a message to bob with end-to-end encryption, then alice signs the message with her private key and bob's public key. then bob can read the message with alice's public key and his private key. so bob knows that the message actually comes from alice, and nobody can read it but bob.)

here's the problem: the public keys are all stored on someone else's (3rd party) server. for whatsapp, they're stored on whatsapp's server. so if bob gets a message from alice, he has to read that message with alice's public key, but he gets the key from whatsapp's server. so whatsapp can do a man-in-the-middle attack quite easily by giving out a fake alice's public key.

actual effective end-to-end communication is only possible if alice and bob exchange public keys in real life. this circumvents a 3rd party server. and this is what needs to be implemented in chat applications such as matrix chat. (you can pass the public key with a QR code or sth like that)

you are viewing a single comment's thread
view the rest of the comments

[–] TheDarkQuark@lemmy.world 4 points 6 days ago

For anyone else like me who didn't understand on a first read what OP is saying (it's not you OP, it's me; I am a single brain celled organism):

Say Alice has generated keys pub_a and priv_a. Bob generated keys pub_b and priv_b and Bob has the unencrypted message msg_b.

We assume:

# Bob encrypts with Alice's public key
enc_b = pub_a(msg_b)

# Alice decrypts with her private key
priv_a(enc_b) = msg_b

Now, let's say WhatsApp has generated keys pub_w and priv_w.

# WhatsApp reads the unencrypted message
enc_b1 = pub_w(msg_b)
msg_b = priv_w(enc_b2)

# And then re-encrypts it with Alice's public key
enc_b2 = pub_a(msg_b)
msg_b = priv_a(enc_b2)

I just did a quick search, and found that you can verify the public key fingerprint. In WhatsApp, it is via the chat settings window -> Verify Security Code.

I also found this white paper: https://www.whatsapp.com/security/WhatsApp-Key-Transparency-Whitepaper.pdf

Although, I have to admit I didn't read it yet (may be I'll read it sometime later).

Thinking about it, I agree that the best way would be sharing public keys over a different trusted channel unrelated to the main service.