Hacker News Reader

Comment by dovdov | Hacker News Reader

End-to-end encryption from your phone to Google's server, where neural networks now analyze all your data, Super cute! Lovely Labrador!

View on HN

From their FAQ:

"Your chats are end-to-end encrypted and can only be seen by you and the person you're chatting with. Google can't read any of your messages, so you won't see any Smart Reply or Google Assistant features."

https://support.google.com/allo/answer/6383724?ref_topic=637...

Who validates that that statement is indeed true, we in our naivety should just plain believe it?

As much as you would any other company - Apple, for example - unless someone trawls through the source code to verify the claim.

Exactly, but somehow many seem to believe Google is different.

As much as people like a good conspiracy, that would be a pretty pointless one. There are tens of thousands people at google who could look at the source code, many of them with a left-wing/civil liberties attitude.

To get all of them to stay silent, and to evade analysis of the binary is, if not impossible, simply not worth whatever they could get out of reading my messages (esp. considering their uninterrupted stream of emails to read).

It's also why the concept of "brands" makes more sense than may are willing to admit: a blatant lie such as this would probably be worse for google than VWs little problem. Reading someone's private stuff is just bound to rouse more emotions than whatever comes out of the back of your car.

Yeah right.

http://www.theverge.com/2016/9/21/12994362/allo-privacy-mess...

"Allo messages will still be encrypted between the device and Google servers, and stored on servers using encryption that leaves the messages accessible to Google’s algorithms."

[....]

"The decision will also have significant consequences for law enforcement access to Allo messages. By default, Allo messages will now be accessible to lawful warrant requests, the same as message data in Gmail and Hangouts and location data collected by Android. "

> all non-incognito messages

> The version of Allo rolling out today will store all non-incognito messages by default — a clear change from Google’s earlier statements that the app would only store messages transiently and in non-identifiable form. The records will now persist until the user actively deletes them, giving Google default access to a full history of conversations in the app. Users can also avoid the logging by using Allo’s Incognito Mode, which is still fully end-to-end encrypted and unchanged from the initial announcement.

> Like Hangouts and Gmail, Allo messages will still be encrypted between the device and Google servers, and stored on servers using encryption that leaves the messages accessible to Google’s algorithms.

Translation:

- Incognito messages will not be logged, and will be encrypted end-to-end.

- Non-incognito messages will transit over SSL, and be stored on Google's servers in an encrypted form that they will have access to (presumably this "encryption" is to prevent hackers gaining a DB dump from getting everything in plaintext).

- Non-incognito messages will be logged indefinitely, unless a user explicitly deletes them. (This is a change from what was previously announced at Google I/O)

Correct me if I'm missing something.

> many of them with a left-wing/civil liberties attitude.

Well they seem awfully quiet about all the privacy invading stuff Google does, considering the number you claim they're in.

It's probably easy to dismiss/justify some of those things when you can view the code yourself to see that nothing "bad" is happening (at least at the current time). It's a little harder to rectify Google blatantly lying about something e2e encryption even if nothing "bad" is happening with it.

Meanwhile with iMessages encryption is standard and "quick reply" + "App interactions" are available...

So basically at Google encryption is a separate feature and come at the cost of the others cool features. This combined with the confusion between "incognito mode" and "porn mode" may contribute to a slow adoption of crypto-features in Allo IMHO...

The encryption for incognito actually is Moxie’s protocol, as used in Signal and WhatsApp. The one single good thing about allo.

Just recently there was a HN post about security bugs in Signal. Signal is open source and the bugs will be fixed at some point, but I wouldn't trust all these proprietary apps will follow the lead so fast.

If there is one think I'd trust about Google is them to be serious about security vulnerability.

"We've released an update to the Android app (3.19.0) which includes a fix. Signal for iOS and Desktop were not affected, nor were other consumers of Signal Protocol. Non-attachment message confidentiality and integrity was not affected. We're publishing our analysis to make as much information available as possible, but given both the limited impact of this bug and the set of circumstances necessary to exploit it, we consider this to have been of low risk to Signal for Android users."

https://whispersystems.org/blog/signal-android-attachment-bu...

But that's end to middle encryption!

But perhaps middle out compression?

Middle-out encryption ...? :)

Reply on news.ycombinator.com