Hacker News Reader

Comment by haloboy777 | Hacker News Reader

End to end encryption is not beneficial to any big tech other than some marketing. Then why are they implementing it? Has anyone figured out any reason behind it?

View on HN

So they don't have to deal with law enforcement. Law enforcement requests tie up a bunch of resources, while also being bad publicity; E2EE lets them wipe their hands of the problem.

At least until governments start implementing laws like Australia's Assistance and Access law, which compels companies to add back-doors on request.

As with everything that involves user data, it’s much easier to implement something that doesn’t have access to it. Otherwise you run the risk of data breach, FCC fines, government abuses (around the world), and so on.

It would help in not having to deal with court orders for data... being able to reply to all requests with "unable to comply" would save time.

Marketing.

Sometimes it matters. Also, it doesn't always have to be some malicious thing. Could just be that there's a visionary executive with altruistic intents who convinced a higher-up that it's the right move.

But in the case of Signal, remember that it's a nonprofit. And in the case of whatsapp, it's looking more and more like the case above.

Doesn't even have to be a visionary executive. This is one of the decisions where a senior engineer writing the design doc one way or the other can easily make the difference in how the final product looks like.

Also, besides marketing, reduced compliance costs. Once police etc. realize that you can't provide useful data, they stop asking.

When the Snowden leaks came out it was a surprise to Google that the government had tapped the data center to data center connections, as these were private and not thought to be tapped. Eventually all traffic between data centers was encrypted to prevent eavesdropping.

Internally there was a lot of animosity towards the three letter agencies for tapping our lines, so part of the rational was sticking it to them.

Also, once you hire a security engineer for one thing they tend to be pretty vocal about other security issues. They can often stir up enough trouble that it's easier just to add the extra encryption.

Adding this encryption to Google's messenger was probably a couple person-years of effort. So, like, 0.00001% of the budget?

> When the Snowden leaks came out it was a surprise to Google that the government had tapped the data center to data center connections

I guess I haven't been keeping up, but I did not know this.

Can you point me to a short documentary or document where I can learn more about what Google says it didn't know?

https://www.techdirt.com/articles/20131030/09554125066/nsa-b... (probably not the best source, but was quick to find and has the infamous diagram)

Google started encrypting communications across its data centers (even though they were on private lines) because of this revelation. Here’s a news report from 2013 [1] about this.

[1]: https://www.washingtonpost.com/business/technology/google-en...

It can't be proved that Whatsapp's implementation wasn't tampered with, however. Both server and client are proprietary. It's easy to claim OpenWhisper was implemented while there was someone looking over their shoulders there.

And when dealing with proprietary software, we can't assume benevolence by default, ever. The most defenseless link in the chain, the end-user, needs do be defended.

Reply on news.ycombinator.com