205
‘End-to-end encrypted’ smart toilet camera is not actually end-to-end encrypted (techcrunch.com)
submitted 11 months ago by [B] to c/pulse_of_truth@infosec.pub
61 comments fedilink hide all child comments
 

Kohler, the makers of a smart toilet camera, can access customers' data stored on its servers, and can use customers’ bowl pictures to train AI.

you are viewing a single comment's thread
view the rest of the comments
[–] 2 points 11 months ago (6 children)

That's not what end to end encryption means. All encrypted transmissions are not end to end encrypted.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 2 points 11 months ago (5 children)

    if Kohler is the other end of your transmission, and the data is encrypted til they decrypt it, it's e2ee. if you disagree, try explaining why.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 4 points 11 months ago* (4 children)

    Because that's plainly not what end to end encrypted means. That's just HTTPS.

    if Kohler is the other end of your transmission

    They're providing the service. End to end encryption maintains an encrypted communication channel between two clients that the service provider cannot decrypt.

    By your definition, all HTTPS traffic would be end to end encrypted.

    The term "end to end encryption" is just not applicable to this context and using it as marketting to users in order to give them a false sense of security is disingenous.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 0 points 11 months ago* (1 child)

    From the perspective of the Kohler toilet camera being the sender and the Kohler shit-reviewing service being the recipient, TLS can technically be end-to-end encryption. As long as the shit-reviewing server is doing the TLS termination itself—and not Cloudflare or a reverse proxy—that meets the definition insofar as only the two communicating parties having the ability to see the cleartext. That's assuming the server has disk encryption and no employee has access to it while the disk is unlocked.

    Kohler calling it E2EE is still disingenuous as fuck regardless of my above hypothetical, however.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •