205
‘End-to-end encrypted’ smart toilet camera is not actually end-to-end encrypted (techcrunch.com)
submitted 11 months ago by [B] to c/pulse_of_truth@infosec.pub
61 comments fedilink hide all child comments
 

Kohler, the makers of a smart toilet camera, can access customers' data stored on its servers, and can use customers’ bowl pictures to train AI.

you are viewing a single comment's thread
view the rest of the comments
[–] 5 points 11 months ago (5 children)

What we're looking for is "zero-knowledge storage". If it's anything else we can just ignore the whole "encryption" marketing. That's because claiming "end-to-end encryption" is still semantically valid if it's transit only and they are the other end.

  • permalink
  • fedilink
  • source
  • hideshow 5 child comments
    •
  • [–] 2 points 11 months ago (3 children)

    Doesn't end to end also mean at rest?

    But at rest still doesn't matter as they'll own the key unless it's zero knowledge like you said.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 2 points 11 months ago (1 child)

    End-to-end means a path from point A to point B.

    End-to-end encryption could definitely include at rest encryption, but only as part of the path that isn't one of the ends. An example would be where a service like WhatsApp stores your message until it can be delivered to the other contact. End-to-end includes "zero knowledge storage" in this example because WhatsApp can not view your message. You are one end and your contact is the other end. The data is stored encrypted at rest (going trough their servers) because their server is neither end. This is literally why end-to-end encryption exists.

    In the case of the smart toilet storage, you are not both ends. Instead you are one end and the storage provider is the other end. The transit is still end-to-end encrypted but it does not imply "zero knowledge storage". They use the term end-to-end encryption because they transfer the data to their servers without people being able to intercept it. And that's semantically correct.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 11 months ago

    it does not. end to end encryption and point to point encryption are two ways of delivering an encrypted message to a destination. a point to point encrypted message has a message and header that are decrypted by every node in the network to determine where to route it next. an end to end encrypted message has its header and body encrypted separately such that only the sender and recipient see the body, but the nodes can read the header for routing. encrytion at rest just means that the message, once saved to disk, is encrypted

  • permalink
  • fedilink
  • source
  • parent