Forum Discussion
Edge continues to be the only major browser with no end-to-end sync encryption
https://damian.fyi/2014/02/09/inside-chrome-sync/ details exactly how Chromium's encryption works and how a third-party developer can encrypt/decrypt. It uses the very standard https://www.links.org/files/nigori-protocol.html, which in turn uses AES encryption.
If Chrome Sync were faking encryption or if it had any kind of backdoor, all of AES would first have to be broken. It may very well be broken by some law enforcement agencies or researchers or rogue actors, but if word had gotten out on how it works, the Internet would literally break.
if they removed it then security firms or 3rd party developers can't know whether data going out is encrypted or not, simply because the encryption method it's not there to begin with.
The way encryption works is that you don't even need a program's source code to know whether or not it's doing encryption. If you can't encrypt/decrypt the data going over the wire using the identified protocol and your own key(s), it's automatically regarded as being insecure.
Chrome is based on chromium and is totaly closed sources, so nobody (event this security firm) now what it do.
So no you can't certify that your encrypted data are really encrypted in chrome.
Kam wrote:
WittycatThen how do I get my other subscription updates?click on profile icon at top right and go to subscriptions, unsubscribe from topics
go to "my settings" => subscriptions and notifications => notification settings and turn them off
in profile settings again go to preferences => preference option and turn this off
Wittycat Look, I agree with you that Microsoft is far more trustworthy than Google.
Even then, Google makes different assurances about their privacy for different products. GMail was (and probably is still) indexed, while your credit card information isn't, for example.
But that's not the point. I never said it was, and I'm not cheerleading for anyone.
The point is that, by using E2E encryption, Brave, Firefox, Chrome all demonstrate a certain level of trust that you can place in them. That trust may or may not be absolute depending on your political bent and whether or not you trust governments.
But none of that excuses Microsoft from not having E2E in Edge, and the fact that they refuse to use it, at best, is simple negligence of an important feature, and at worst, is them acknowledging that they plan to use the data.
Raising the expectation of privacy deters abuse and raises accountability, both in terms of user acceptance/adoption as well as legally. Edge's expectation of privacy is far lower right now than any other browser, which, for any browser by any company, is completely unacceptable.
https://en.wikipedia.org/wiki/Expectation_of_privacy
just like me, when you and other discuss and i don't want to follow i go up and in the first post settings in clic on unsubscribe and poof no more spam from this post (and if you will have email only on @mention)
but i will follow the exemple of HotCakeX, and just stop trying it seems the owner of this post don't want to understand than closed source software can send data in you back without being caught
- disable this fonction then because here we are in discussion so if you don't like the discussion change your email settings ....
- yes and they already been take the hand in the honey pot, but since they are number one and unavoidable in the market everyone don't care.
Google doesn't stop spying more and more and taking more and more data and everyone doesn't care because it's Google.
Microsoft in the other hand don't have this possibility, since Military and Entreprise work with them, and if they do that they are finished, since more user have android than windows or microsoft product.
90% of the user of Microsoft are Gamer or Entreprise/Military
Because now in the house it's more Ipad + Android than PC with windows. Wittycat Don't say "you don't even know how it works" because all this chatter (including mine, HotCakeX) is spamming everyone's inboxes even mine, I had 59 unread emails (all from the Tech Community and this conversation) when I came back from a coffee break and wow, may have to spend my time deleting my hundreds of emails. If I'm right this is spamming ragingrei, HotCakeX, Aelisya (you) and my inbox.
I don't know how many times I have to explain that even the credible promise of E2E is adequate to deter Google from abusing any data that they glean off of you. The more convoluted the attack, the less likely they are to be able to abuse it, because it's more difficult for them to reveal their hand.
Quoting myself:
Again, the point isn't that it can't be done; it's that it's difficult to do in plain sight. The point isn't to limit what openly bad actors can't do; it's to limit what supposedly good actors can.
You're appealing to cryptographic nihilism in order to rationalize Edge's lack of E2E. Even if you were right that it's technically possible, it's completely absurd.
If Microsoft hands over their data to third parties (say, an advertising firm), anyone on the Edge team can do so, and they can cite a loophole in the user agreement to say they had the right to do that.
If someone at Google pulled the same trick, they would have to admit, both to the advertising firm and to other employees, to having transmitted a password. Jail time would be involved, entire nations would ban Chrome outright, and no one would ever, ever rely on them again.
Do you honestly think they have the financial incentive to risk that?
- nope, you totally don't understand how a software work and how we can send data without bein detected even by mitm, why don't you think governement want it gone so bad ? because it's not simple to be SURE the software don't send hidden data with a hidden connection.
For instance chrome can very easily send date when you connect youself direcly with the header and a double encryption without saying anithing, and if (just like some time ago) you haven't some security researcher who find it.
You will NEVER know it's there.
AES is for now secure but it's implementation is critical, if you add "by accident a bug" (is what the NSA as do in the past) in the implementation you can weaken the encryption so bad that even my nokia 3310 can crack it and being compatible with other implementation.
