I learned a little something this morning because when I've been I have a Sonos one speaker that's hooked into to Amazon and I have a friend named Alexia and so when I say that the similar word I just feel like I'm talking to her but she's not there and it's not my preferred word yeah if you have an echo you can change it to computer or sorry well we're gonna say the word computer but and then there's like one other option echo is the other option okay which is really awful because anything but yeah default right I never thought about changing it until today and now I'm like oh man so I know people have changed it to computer Derek Chen for instance changed it to computer and he says it gets that's all it gets set off a lot more yeah just that word comes up more he's like that was my only option I wouldn't even bother yeah to not even have the option I'm like yeah I guess I'm stuck with this for now yeah well was the news yesterday or today that oh I think you can change to Amazon too that's what it is yeah which is like that would be mayhem was was the news yesterday or today that they're selling like two Sonos ones for the price of one home yeah that's today that today everyone noticing like hey guess what you can get a really good speaker twice man that's that's tough sledding uphill in that in that market specifically when when the push is good sound and Sonos is the brand for some good-ass sound the only the only problem for Apple there is that Sonos is a favorite of Apple fans if that was Bose Apple would be like well all the by the home pod I still think all the Apple fans are gonna buy the home pod yeah there's certain people who are just like I just want that Apple product and it probably will have great sound but my two of them yeah my Sonos ones and I mean I don't know I guess I could add a sub to make it like really booming but I'm never really listening to music that loud in here the sound is great yeah no Sonos sounds good and and again that's what Apple has been selling in the see that store like I love Apple stuff most of the stuff that Apple offers that has an option for Apple I buy however I'm not be buying a home pod I don't consider you the the the Apple fan though you're you're you're an Apple appreciator I mean but I think Apple fans who are like already pre-ordered I'm ready and I'm like it's not even January 26 you couldn't possibly have pre-ordered they're like nope I figured it out somehow like they just buy everything that comes from Apple unless it's really bad I used to be that person yeah but I also used to host shows specifically about Apple yeah all it was you shall here we go hello all you beautiful people the Daily Tech news show is brought to you by you you can find out more at that Daily Tech news show dot com and we thank you for your support this is the Daily Tech news for Thursday January 25th 2018 from DTS headquarters in Los Angeles I'm Tom Merritt and from Studio Feline I'm Sarah Lane from the XFL fan club I'm Justin Robert Young we're all back in our natural homes Los Angeles Studio Feline XFL fans it's the 90s all over again Justin oh it's all coming back to me now yeah a man who never left his home is Roger Chang our producer I did leave this morning and went outside I came back before the show though I take it back he has in fact left the house recently so there you go disappointed here is everywhere let's start with a few tech things you should know Samsung sent invitations for an announcement at 12 p.m. Eastern time February 25th which happens to be the day before Mobile World Congress begins the invite reads the camera reimagined and then it also has the number nine so probably hinting at a camera focused Samsung Galaxy S9 this one will see in two-year soul Chrome 64 launch Wednesday the pop-up blocker now prevents abusive experiences like transparent overlays or website disguised as media controls like a play button it also includes an option to mute audio on websites keep on kicking Chrome research firms canaless and counterpoint both agree that in their estimates Xiaomi is now the top smartphone seller in India bumping Samsung to number two Xiaomi and Samsung both make up around 25% the the actual number differs between the two research companies but they both have about a quarter of the market followed by Lenovo Vivo and Appo you have to end with an O to stay in the top five unless you're Xiaomi or Samsung well let's get to some more top stories Justin Nintendo announced it will close its meat homo social app on May 9th the app was launched on March 2016 and let's friends learn about each other through questions and answers this seems like a bygone era for Nintendo apps in the wake of some of the more popular ones that have actually caught on like Animal Crossing but it was only March was less than a year ago that they launched this thing every day it's not just Nintendo like every question and answer platform I can think of a few of them they all have a lot of popularity for like a minute and then people are like I don't have any more questions yeah yeah it was it was the peach of its week is how I described it to Justin earlier today you know it was really exciting and fun for that first week I don't think I've talked to Anthony Carboni about anything on the internet more than answering his questions and answers with his virtual avatar in me Tomo but it's enough staying power and honestly this was Nintendo's toe in the water to be like we're trying out let's just see and I think it was good for that and it makes sense to be like great we've got real stuff now like Mario and Animal Crossing and Fire Emblem we'll we'll just get rid of that toe in the water test now sources till Bloomberg's Mark Gurman that Apple is working on a redesign of its iBooks app for iOS after hiring executive from Amazon the new app will supposedly have a simpler design the bookstore section will resemble more like the iOS app store itself and the app name is supposedly said to be changing to books from iBooks that part of it I like because it's just it is a book yeah the way that you're reading the book is whatever but it's not an iBook it's a book well and also they've they've phased out the i from everything Apple music Apple TV yeah home pod wait you know I was having a conversation the other day with a friend who was asking me you know my thoughts on a new iPad right like sir you're the iPad person and I was like you know I haven't used an iPad with any regularity since the iPhone went plus-sized yeah because the iPhone just kind of became big enough that I need to read more on my iPhone regularly but this is certainly something that makes more sense for the iPad crowd when it comes to Apple and I just I wonder how much people are clamoring for a redesign well I think everybody's shooting for Amazon because you see this happening which by the way W. scottis one points out that in the 11.3 beta one it is called books so that part is not even just a rumor that you can see that yourself in the beta but you also have Google getting into the audiobook side going head-to-head with audible full force so I feel like everyone who's got the oomph you know the big guys sees an opportunity to steal a little market share away from Amazon for some reason not that Amazon's laying down on the job but just no one has challenged them directly and and and I'm not saying no one has challenged them directly in that Apple didn't have its books before but they haven't really put a lot of effort behind it and it looks like they're going to try to get serious about moving that needle look let's be honest here they are playing for number two anybody who is in the ebooks game against Amazon Amazon just has this industry on about as fierce a lock as anybody has any industry and so if if you know Apple can say it look you're already in our ecosystem you're already using our hardware we can make a pretty experience and an easy experience for you to buy the book that you know that when fire and fury was the biggest thing in the world for five seconds three weeks ago buy it here it's easy to buy here you're not probably going to have the discovery that Amazon really has their bread and butter on their bread and butter with but at least it'll be a nice easy way for you to enjoy something that you were going to go out and get anyway and Apple has the competitive advantage that it has given itself if you live in the Apple ecosystem entirely it's easier to use the books app because you can get to the store whereas with the Kindle and everything else they're like we're going to take 30% and so nobody sells their stuff through their apps that way they require you to go to the web so there's some friction there that Apple could take advantage of friction that it has created yes but but friction that it can take advantage of CNN has shut down YouTube star Casey nestats video platform beam which had bought for $25 million back in November 2016 they were going to use it to build an online news show presence for the younger demographic nest that told Buzzfeed he couldn't figure out a strategy that worked within CNN and will depart the network CNN says it's going to re-employ most of the 22 person beam team that's B E M E by the way but I mean hey his quote is I couldn't find answers I would sort of disappear and I would hide and I would make YouTube videos for my channel because at least I would be able to yield something sounds to me like he was frustrated with being inside a corporation and having Casey right having people say and believe me I I understand having people say like well you can't really do that well that's a good idea but what if we did it this way and he is like no give you get you bought me for a reason let me do my job yeah I mean I don't I was not super familiar with him before the CNN deal went down because I just I'm not up on my YouTube stars as much as I should be and to hear his quote it's like yeah I mean who knows how hard he was trying to integrate himself with the way that CNN works I have also never worked at CNN but I do know the frustration of being somebody who's like here's what we do we're nimble you know I got an idea for a video it'll be up in a couple hours this is you know how it works and having a lot of executives bottleneck that entire idea 22 people on a team is not I mean that's pretty significant amount of folks it doesn't sound like they had much to show for the you know the effort after CNN became the parent company besides a handful of videos over the last year and some change so that's a pretty big bottleneck that idea jeans is what Casey was wearing when CNN acquired him this is just a loser of an idea it was a loser of an idea when current tried to base the network off it way back in the day for user submitted video to be the dominant form specifically when there's already a very rich platform for user submitted video called YouTube that automatically finds the things that everybody knows and therefore the richest stories that CNN can report on it's interesting to have another tool so people can report stuff from the field but to be honest did we really have a problem recording video and getting it out into the news stream no the problem they were trying to fix is we don't get millennial uptake so CNN thought hey even if it cost you a million dollars to replace those bad idea jeans you can buy 25 pairs of pants because we're bringing you in house if you remember beam worked by making you put the phone at your chest level yeah so that you couldn't see what you were recording the idea was like let's have some authentic interaction and it was getting a little bit of uptake because of like oh that's new that's what CNN bought was like we want somebody who come in and make millennials pay attention it's not that we have a problem getting the video it's that we have a problem with them coming to us to watch it maybe this is the guy who can do it and it sounds like they just could not speak the same language some of it may have been interference from corporate types like we talked about some of it may have been just CNN saying you know journalistically no we can't do that where a startup that Casey runs on his own can kind of fly be free and do whatever it wants well and really I you know 25 minutes less of a overhaul than CNN saying OK let's replace some of our anchors and you know to launch new shows for like the younger set and really alienate the people who are already watching the network right so it's like it was a it was an experiment yeah it's that of building really have anywhere to go instead of building a new thing they bought it and it didn't work the shock that a network that either does 24 7 wall to wall political coverage or bringing every last drop of nostalgia out of various decades that happened 40 years ago you know wouldn't be a place for millennial viewers hey I like those decade shows they're good they're good they're good at the need for a series gotta say yeah Bloomberg sources report that Twitter is working on get this a Snapchat style tool for posting videos a working demo of the camera centered app has been made but design and launch timing have not been settled also in a blog post Wednesday Twitter described its use of neural networks to show the most interesting parts of a photo in its image previews now I am supposed to know that I am more excited about a possible Twitter Snapchat Instagram stories competitor than I am about a preview cropping I'm way more excited about the preview cropping because I put posts up sometimes the photos or I see others and I'm like I can't really tell what that is and it's kind of annoying to have to click if they if they've used a little AI sauce to make that work better and always have the interesting part in the preview window that's great I'm excited about that that makes my Twitter reading experience better the idea of them coming out with a separate app that'll allow me to do like short video posts to Twitter man yeah I am I am here for that take Tom it's cooler that we're figuring out how to that we are machine learning how to better edit your photos than it is to have yet another way to take little snippets of video that only live on one platform well you know the Snapchat style tool like okay I get that we're calling it Snapchat style because that company sort of coined this trend but on Instagram it is really popular so in that sense you think okay well Twitter offering something that's a little bit closer to something that clearly is in use and sort of beloved by a certain amount of people that's fine I don't need this from Twitter I don't need this from Twitter like I didn't need periscope from Twitter or a variety of other things that they've tried over time and we'll name really all that fun divine but I agree with you Tom that the photo preview window when I first read about it I was like I mean how much different could it be but the examples that you see you're like okay instead of like a weird blob you see that it's a photo of a cat you know and like it's right in on the eyes of the preview and then you know click the the photo and it's the entire cat so yeah it's that part of it is I see I change my experience but it's cool Twitter said well no Sarah the cat pictures will look better and you're like oh I get it now there was an example of a cat so any cat photo that's I know you're not like yeah I was interesting I was in a group full of other Patreon creators yesterday and everybody kept talking about Instagram stories I think Snapchat came up once I mean look I went whole hog in Instagram stories when I was out there in Japan and I as somebody who has previously used a lot of Snapchat I think that there's a lot of product improvements that they made that I think Snapchat kind of got left behind on I think they made a better version of their product I still don't have the new Snapchat design that was announced at the beginning of December I mean right I don't have it either what I mean why even announce it if it's gonna roll out that slowly it's a very bizarre all right moving on New York governor Andrew Cuomo signed an executive order Wednesday preventing the state from contracting with ISPs that don't follow net neutrality principles ISPs would lose state contracts if they quote block throttle or prioritize internet content or applications or require that end users pay different or higher rates to access specific types of content or applications here we go yeah this one's trickling out right we had Montana on Monday we had AT&T yesterday and now we've got New York and granted it's very partisan right now all the attorneys general that are filing lawsuits or Democrats all the governors to the two governors so far that have have done this are Democrats so it'll be interesting to see if this ever crosses party lines or if it remains a particularly partisan issue but it is a clever way for states to try to force net neutrality and get around that FCC prohibition against past season laws for net neutrality statewide they can't do that and not run up against the FCC trying to shut them down with the new open internet guidelines that are going to go into place but they can decide who gets their contracts so here we go one more I I think there's a lot of momentum building for there to be a showdown in Congress about a new bill AT&T putting one out like that Burger King running a net neutrality whopper analogy shows that it's definitely part of the zeitgeist well burgers whether we're actually going to get any agreement any any cross the aisle this is what we can do and create a 1996 telecommunications bill so type thing right now it does not look likely well I mean this you could make the argument that this is states using the market at work right yeah for sure contracts are a huge parts of the budget are huge parts of the revenue for these ISPs so if you say look if you run afoul of this we will wrap you on the knuckles by taking you out of these gigantic lucrative contracts then that is something that that they might pay attention to yeah I would still love to see just an updated framework you know some kind of a look from from our congressional system to show that the internet exists it's an important part of the world you know sometimes please as self-interested and broken as AT&T's proposal was yesterday it at least is the right step right if you say all right leave google and content creators out of it that's a whole separate issue and let's put paid prioritization in now we got something to talk about so I don't know nothing's impossible I guess uh courts has an article from David rose futurist in residence at idio about how gesture interfaces not necessarily voice or what he calls haptics touch interfaces might be the future he really doesn't say that one is going to win over the other but he's like gesture interfaces might be the best way of interacting with a lot of devices rose points out that depth sensing cameras and neural nets can be trained to recognize specific people classify their activities and respond to gestures from afar so in loud situations uh voice isn't practical when your hands are dirty or or or you're you need to keep your hands clean like you're a surgeon uh touch isn't a great interface so he found that gestures are better in four particular cases when you need speed uh he found that gestures seem to be quicker uh when you need to do something at a distance and far field voice can can do a lot of things uh when you have a limited lexicon you don't want to say a lot of things you don't want to describe a thing like you do in voice you just want to point to the light and turn it on gestures are good for that uh and expressiveness over precision you know when you just you just want it to stop you don't need it to stop for 10 seconds and do a thing or or something else this is an interesting idea i i don't know if the answer is either i think it is probably closer to and however the only thing about that would worry about gesture stuff is number one the idea that to to record gestures you need some sort of visual recording medium right you need some kind of camera yeah you need that at enough places to make it easy the one thing that i think has made alexa sorry uh make the echo takeoff i apologize to everybody said me hate tweets justin are young i probably turned on someone's light when i pointed earlier too on the video uh is that you can be anywhere and you are constantly surprised by how far you can be and how low you can talk and how in in whatever garbled speak that you can get positive interactions i have yet to see not to say that it's not impossible but i've yet to see a practical example of gestures having that kind of oh wow it worked reaction yeah same uh and let me know with the exception of like he's not saying it's there he's saying this would be better if we developed it more sure yeah i guess i i to to say the idea of an audio only internet is something that i have longed for forever and i think that that that was an element of the echo that i loved i can't think of a time where i was like ah man if i can only just say thumbs up to go to another web page well i'm definitely sorry you tell me if this changes what you were about to say i have definitely wanted to control something without touching it or having to say anything out loud because when he says it can be he says in this article it can be embarrassing if you say something out loud not because you're asking about a rash or anything maybe that's the case but just like sometimes you're like i don't want anybody to know what i'm talking about it's just weird i i find that i never use siri out in public for that very reason i'm like it's not that what i'm saying is so embarrassing i just don't feel comfortable talking out loud to my phone sometimes i don't want to touch it but if i could just be like you know just bring the volume down that would be great i i suffer from the same thing we were talking in the pre-show you know where i i wish i could change the you know the wake command to something besides what it is now because i have a friend with a similar name and it just makes me feel weird um it's not it doesn't make me feel weird because she's you know is going to hear me or anything it just feels weird and sometimes when i say something even though i get my answer right away i just like yeah it's convenient but it's not always ideal for me like i just don't want to talk sometimes just your stuff if it worked well and yeah i mean it's like i don't know just wiping to go to you know the next story or something like that it's like if it worked well i would be into that the way that i was into you know the nintendo wears you know back in the day but um i find that that is i mean talking about like feeling stupid that's way worse potentially um well it depends on what the gestures have to be right totally and i feel like you're both like yeah but gestures don't work and it's like they haven't yet voice didn't used to work either there was a time when voice control devices were laughable because you're like they can't tell what you're saying half the time and now they've gotten better so you can get it where it's like subtle gestures like you know finger stuff or whatever you know with that understanding i would love to see it work but when the app seri came out i downloaded it because i was very excited about the potential even though it was hit or miss gotcha gotcha i mean i still from the beginning yeah it's still hit or mess but i'm constantly especially when i'm in my car i'm using it and you know kind of sometimes figuring out like oh here's the workaround you know because she didn't really get what i was trying to do in the first place oh yeah seri particularly has a long really there's you know we have ways to go she i always think of seri as a he now because i changed mine to be a british man right so it would sound like another thing that i just have a personal like it makes me feel uncomfortable to think of these things as genders that's why i don't want a name that reminds me of a gender i don't have a good reason for that it just makes me feel weird hey seri how are you very well thank you oh well it's not nice solve my problems with that big strong hand it's a sophisticated voice hey if you want to get all the tech headlines each date about five minutes subscribe to daily tech headlines we do it all for you all the headlines of the day in one five minute package you can get them on the amazon echo just by talking to her uh you could also get them on the google home you can get them on the anchor app and you get them as a podcast that's our most popular way of getting them at dailytechheadlines.com you know tom speaking of uh male british voices i think this would be a good time to check in with Nate Langston to find out what he's been talking about the uk lately thanks guys this week we've gone deep on a major topic that the copyright industry and the government in the uk has paid for a whole load of educational materials for schools in britain that aim to teach kids why downloading illegally is bad to make fun they view some puns which i like such as justin beaver and some analogies that i very much don't like such as the lesson that downloading a copy of a song is the same as stealing a product from a shop and there's a chance we try and teach the government a lesson in the show that maybe educating kids about why sexting or libel might lend them in hot water or jail might be a better use for at least some of the money that's available now at techpodcast.uk ah thank you Nate you wouldn't steal a policeman's helmet would you why would you steal a song thanks to everybody who participates in our subreddit you can submit stories and vote on them at dailytechnewshow.reddit.com we also have a facebook group where you can bat around ideas of the day at facebook.com slash groups slash daily tech news show we look at those we look at youtube we look at our blog and we look at the email to find out what's in the mailbag sarah speaking of email yesterday we were pondering Meg Whitman's impending job change and thought you know she's such an enterprise gal why is she why is she going to this sort of like video short form startup thing chris in sunny st george utah as he describes it says well okay in looking at her time at hp you missed why this might appeal to her she was the real first business executive at ebay guided their growth from a tiny startup to a big mega retailer in my opinion that was her biggest professional accomplishment and even if she spent hundreds of millions of her own money when she ran for governor of california she's wealthy enough from ebay still that she doesn't have to work for money so how you another startup opportunity sounds like the perfect passion project for her and maybe it is maybe it is so i think if i can paraphrase what chris is saying is she likes an array of challenges right and maybe hp was just like everything's kind of been solved it's all about moving levers i want a sample of lots of different challenges so this would be whitman sampler of oh stop well i also you know hey i would try lots of things too if money was no object right so it's like when you think in terms of like oh if you just want to try something and if it doesn't work out great and your livelihood kind of you know things aren't going to fall apart if it doesn't work out well yeah a lot of us might do some some some sort of career pivots as well this isn't really a career pivot necessarily but it does seem like yeah it's a it's a it's a different thing than what she's been doing for a long time and at any age sometimes people want to do different stuff yeah i hope it turns out to be her cherry cordial me too william writes as a shift supervisor at a grocery store i'd like to dispel this idea that pricing problems are some kind of game or laziness nobody has missed pricing items on purpose many times probably seven out of ten times that the price is wrong changes have been pushed by the home office and the overnight crew has gone through the entire store trying to find tags that are outdated if you ever pay attention to how many sale tags there are in the grocery store then you can realize how easy it is to miss one or two or sometimes even more other price changes are generally handled by a department manager for either overstock or approaching the sell-by date what really becomes annoying though is what scott mentioned the clearance area often only a few of an item make it to the clearance area and some customers treat the area as a drop-off for items they decided they didn't want organizing this area all the time is impossible and it's the number one cause of false price concerns in my day anybody is like what is this all about on monday we talked about amazon's new cashierless retail store in seattle yesterday in the mail bag section somebody had written in and said here's you know there's going to be a challenge here because you're going to notice fewer mismarked items on your way out which does happen having worked in a grocery store in my youth as well um i definitely agree with william where it's like oh you know it's really hard to keep a grocery store running smoothly all the time so i think there's a little bit of a um hey you know don't don't act like we're not trying our hardest which i don't think anybody was saying i i think the concern was somebody who's constantly on the lookout for these things wouldn't have an easy way to complain to the checker about them uh and frankly i'm not there i'm the opposite i'm the kind of person who's like you know i i as long as the total doesn't seem outlandish if it's about what i expected i don't look at it in each individual item really uh yeah i mean although i could sympathize with all the the poor stalkers and checkers that oh yeah no absolutely and i don't i don't think grocery stores do it on purpose i i don't think it's some kind of pump time maybe there are a few out there i'm not going to deny that they're they're shading the sinister grosser we are on you buddy grocery bad apples ruining it for everybody this apple was supposed to be 99 cents a pound not a dollar nine a pound oh but but the label's on the can though right price is on the can i screwed up that atlantic quote uh well that well you know you don't screw up just rub them i know you were uh excited about what some new football league before the show besides that what else you have going on these days i was i was uh uh just talking about the new the new newly relaunched xfl in 2020 but that's nowhere near as exciting as my politics podcast and that is something that you can find on itunes uh and anywhere else that you get podcasts or you can just go to politics politics politics dot com uh a lot of uh exciting things or terrifying things happening in the world of politics if you want to even hand it uh a funny humorous place to deal with all of it then go ahead and do that or here's another thing that you can do for absolutely uh zero dollars out of your pocket go to tiny letter dot com slash justin robert young that brings you a politics newsletter five days a week for free headlines and hilarious commentary for you for nothing hey folks uh kevin writes so glad my dtns hoodie is finally here it's already too warm to wear it hashtag texas weather but maybe i'll get a chance next week you never can tell hashtag ibbid happy to have another way to support you guys you should maybe rotate the different ways to support the podcast instead of talking about the same ones every show it can get a little repetitive for the regular listeners well if you're a regular listener you know i do change it up but we always mention the patreon i know what he's saying uh so hey folks if patreon or playpal or any of those other ways are not your thing check out the store we even have borne ready onesies now at dailytechnewshow.com slash store our email address is feedback at dailytechnewshow.com see there's like so many ways you can get a hold of us we are live Monday through Friday at 4 30 p.m eastern 21 30 utc at alphageekradio.com and diamondclub.tv and our website is dailytechnewshow.com tomorrow is our monthly round table show with chris ashley shannon morse ellen peralta talk to you then this show is part of the frog pants network get more at frogpants.com good sound effects what should we call it hey what i will be right back all right there's uh twitter twitter snapper apple's taking another bite out of ebooks cnn couldn't find a balance with beam uh i can't touch this hands-free internet the era of i is over bad idea genes woke burgers burger neutrality um gotta end with an o the peach of its week mitomo in the water cnn crosses the beam beam me up cnn beamed out can't pick the cat pictures look better ui can't problem the problem with picking the title is that roger you never sound excited about any of them uh you feel like you like we've ordered you to read the list and you're reading the list well i i don't know i don't know how to make it better i i'll take caffeine pills maybe that work i mean i eat me up cnn that's amazing there we go that's good i kind of like that one now um you see there's one in here that's like super clever yeah there's usually at least one i like i know it doesn't have a lot of votes but i think there's no i in books is funny that's pretty good that is good where is that one i don't see it it's uh stoic slow mitomo here i'll vote it up should be three yeah i'm doing it it also should be a lower case yeah yeah i agree make it so tom see done i mean i feel tremendous power whenever i say which one i like the best because then it becomes the number one i know it always just because everyone's like okay we want to like support so i actually want to support you guys so like listen to me with a grain of salt but that's very difficult to listen to right but you can hear the sea yeah who wants a salty person healthy here you can hear the ocean if you have a salty saltier than they are already uh did you see that there was a a player code of conduct uh fine levied in the overwatch league no kid you could uh flip the bird find out oh this is after that that makes sense yeah that's why you need a new a new overwatch oxo watch the league no one's none of this flipping the bird we're going to speak to you say uh i've seen gesture with vince mcmoorheim as the commissioner wow come to the axe oh uh uh yeah you know i mean i'll tell you what the biggest thing about that story not to go back to it because i'm obsessed and you are yeah i was gonna say you this is really on your mind i could tell and listen if no one's gonna talk then i'm just gonna talk about this so uh uh the biggest thing that that is true is that the media landscape and this is something that tom has been on top of for for years and years with uh with court killers has never been more robust there are so many people that want to get hashtag content it is the only thing that matters in today's media landscape not that you have prestige content although that counts but just anything to get in the game fill a bucket yo yeah can you do anything uh go go go go go that's it i mean i was hoping that there'd be some kind of discussion that's fine we can just oh i thought you were still going i was waiting for you like because you're like the thing about it is they needed to fill the bucket i was waiting for the and so there's a lot of buyers i mean that that's really the my my my larger point is that if you look from you know for what is going to be the roaring 20s of media uh it will be yeah number one probably new giants emerging in facebook google uh and amazon in terms of them possibly replacing the media giants of old of network television yeah also you know what do the what becomes of them what becomes of nbc fire me specifically now that they've all been bought by larger companies well so on the sports side of it i've often thought that the end game for the major sports leagues is we're going to own and stream all of the content and you'll get to simulcast some things this is what overwatch is doing right they're like we own major league gaming yeah so everything goes on major league gaming uh but we'll do a deal with twitch uh and twitch gets some perks out of it but that's just so we can extra monetize it and i'm like that seems to be the model for sports but what the xfl seems like they might do from what you're telling me anyway is not do what the wwe has been doing like we're just going to go straight to straight to stream but rather partner up do do a more old-fashioned deal and partner up with the broadcast network well but but wwe is still does that traditional deal for their live weekly programming sure they still do that deal for for bra and smackdown which is what's weak so uh they are very much still in that game of selling content and they just did their first exclusive deal with facebook that's airing now over the next couple weeks so uh this this is something that uh i think is is still going on hold on breaking news breaking news like tv z gone paul thorot just sent out his regular email with the title there's no i in books uh so do we do we just say hey paul great minds think alike yeah i want to i want to uh publicly shame paul thorot you think he stole it from us i think the email went out before we had our conversation unfortunately i don't think i don't know if you could make that case fighter how about we change ours there's no i in books paul well wait did he is his uppercase or lowercase uh tv z gone he put quotes around the eye which is exactly what i was gonna do uh well um yeah i i do we feel that there's enough overlap that people would be like hey dtns stole this uh well there's enough overlap that people will go hey you guys do you have the same title because that's happened with tech news today before like hey you guys have the same title isn't that crazy well i mean well do you want to pick something i don't want to spend a lot of time picking something else well there were other good ones hold on um i don't know what don't copy that bobby means no don't floppy that's the the old uh anti and the bobby is a word for british policeman and i said you wouldn't steal a policeman's helmet deep cut okay yeah that makes no sense to me okay um what about uh woke burgers what i don't know if you caught that one i yelled woke burgers when you were talking about that's what you yelled i couldn't i couldn't bake out a yell all right uh funny i i got like millennials are killing cnn that's i don't know if you need cnn is killing beam but millennials are killing cnn is kind of funny as a meme all right sure all right we're in millennials are killing cnn oh this just in uh mary joe thoroughly has released an email uh millennials are killing cnn but paul's email all right millennials are killing cnn oh wait and now i can upload okay here's the thing though all of you listening or watching i don't care if it's live or later you have to go on twitter and at reply paul thorot at thorot let's say hey dtns you know let you have that that headline yeah out of our infinite mercy we're just that generous where we we admire your shared brilliance and coming up with it and we graciously change but don't let it happen again ever that's right get one paul you get one everyone gets one they all get one yeah we saw paul it's yes it was nice uh catching up saying hi hi paul hi that's what that's that was rodent the extent of roger's conversation these hors d'oeuvres are delicious how do they make so many oh paul that now that we've let him use that headline exclusively uh he needs to be on our show yeah in fact that's a great idea yeah now what happens with paul is i think oh let's have him on when there's a microsoft story and then a big microsoft story shows up and i'm like hey paul can you be on the show he's like no i'm too busy covering this big microsoft story yeah for my own site shows so yeah so we should just book him microsoft trend stuff or maybe like yeah after the microsoft story you need to have paul on yeah just have have sort of a bird's eye view of like all right so where are where things stand yeah i think that's a great idea on the grand road map the other idea um that i was kicking around with darin kitchen yesterday we were messaging back and forth is to do a crossover security round table with hack five that's a great idea did you finally get him on the platform that i did because as soon as soon as you told me like oh i always talk to him here i was like let me try that and he's like hey what's up i told you man that crazy no it worked like a charm uh i will share this tip with you roger once we're off air i had to get a hold of darin yes because i haven't had luck to pass two or three no and he he apologizes he's like oh i'm sorry i've been really bad at email lately lately but yeah i think that'd be fun to do like because he was like we should he's like they've been talking about doing a security round table for hack five i'm like let's uh let's have the love boat dock at fantasy island wait what did no one gets that reference uh is one of the first famous television crossovers was the love boat docking at fantasy island oh yeah i didn't know that that had the subtitle and all hell i thought it was because there was like some bar over where hack five is that's like tkish i thought that's what you were my hip started i'm committing house brother was on an episode of well when i said that to darin he did get it and he said or the jetsons show up on the flintstones that wasn't a very good episode at least you've got the reference yeah i think it was i don't know if it was a theater movie but it was like a direct video it was like a feature length video yeah yeah but yeah but i definitely watch that man i love that you love the honey mooters animated form uh i mean i didn't know is a total rip but like you know sure yeah i loved it they're good how come uh fred and uh velma what's his what's his name wilma wilma yeah how come they both sleep in twin separate separate twin beds that's the way i love lucy had the same thing yeah because it's scandalous to think married people you couldn't show people in the two you could shouldn't show a man or a woman in the same bed on primetime tv back then um i love lucy is one of the best shows ever made i know everyone agrees with me on that and the bedroom scenes were just my favorite because they seemed so weird you know like her nightgown was always like yeah you know and um you know and they okay well good night good night dear you know and then they'd like get into their beds on opposite sides of the room and be like is that how it was you know my my grandparents my grandparents had separate beds like that i always just thought it was how old people did it i thought that it was like that that wasn't like a standards and practices thing that it was just the thing was is like in the show they were old right they had the little movie but my grandparents were the same age as them so oh yeah i guess like they were just they had always done that supposedly which is like i mean hey people are having kids so there's more to the story but something yeah they pushed the bed together at some point or something yeah also i know this this i'm probably not the only one but you know i was watching i love lucy reruns after school um and it just i just loved that show yeah i did not know that lucille ball was a red head and sometimes and because it was black and white sometimes during the show like there'd be like a red head you know and i'd be like i don't get it i don't i don't understand refer to her hair when no one could see it like there was no color tv it wasn't like oh well some people can see that it's red like but like she was a star so that people knew she had red hair but like even like magazine had black and white pictures like you just had to know you could never tell right but if you didn't like i was just watching some show that was like on channel two because that's the channel that the babies that are put on you know kind of thing and i remember like what finally someone said like no no no she's not blonde she was like really red yeah i was like i thought it was a blonde too oh okay so funny like i thought of them it's like colorless nobody had any color with people it was less offensive back then yeah funny great show great show everybody right now good five stars would watch again uh we will be back tomorrow with the round table so stay tuned for that we've got some awesome topics lined up see you tomorrow


just go ahead I see no slight yet I see no slight yet I guess I'll wait for that right there will be slides sorry that looks blue yes are you happy I am at least a lot happier I was five seconds ago yes amazing Berlin is there all right welcome everyone thanks for well staying in most cases I hope you're enjoying the 33rd Congress as much as I do so me I'm your sports leads I live in Berlin but I'm Dutch I've been doing open source stuff since the early 2000s mostly contributing in the KD community mostly around marketing and promo then I became community manager for open SUSE and a couple of years after that I was hired by my friend Frank Karlecek the founder of oncloud to become community manager at oncloud and then later I joined Frank and the other engineers to go to next cloud and you know continue from there so today I'm gonna talk about well I'll quickly introduce next cloud so you all know what that is about and then I'm gonna talk about our end-to-end encryption which is the main subject of this talk I'll try and detail why we designed it the way we did before I go over the design itself and in the end well I'll go through some edge cases and I'd like to hear some input and feedback and questions however if you have questions in between you can also try to wave at me I think I can see everyone and I'll be happy to answer in between as well so starting with next clouds next I was essentially started to help users protect their privacy so to keep their data to themselves and well to themselves would be self-hosted so next cloud is a private self-hosted cloud and with the buzzword cloud I mean file sync and share but also document editing audio video calls communication collaboration essentially so the whole thing that you get from Dropbox or Google Drive next cloud is meant to replace it that's our dream in life essentially so initially the project was started in 2010 own cloud and in one and a half year ago we split off from own clouds and continued under a name next cloud so it's fully open source easy to use that's I think really important if you want to replace Google Drive and Dropbox and all these things you need to be easy to use good integration in your infrastructure also for companies so as an enterprise if you want to provide file sync and share and collaborative editing to your employees next cloud offers you integration in LDAP and with Semmel and you know nice developer APIs mobile interfaces as well etc. there was a list of features I was just yapping off sorry I'm a little confused with the two options here so let's talk about end-to-end encryption this has been something we've been talking about for a long time because if you have a web interface where you can share files and edit files and you know send a public link to you know your grandma with your holiday pictures or send you know open a video call session with a colleague from work the web interface is obviously really important in all of that and end-to-end encryption means that you protect data from the server that is at least the way we describe or developed end-to-end encryption so the goal of our end-to-end encryption is to protect your data even if you can't trust the server for one reason or another obviously next cloud is self-hosted so you should trust the server in most cases you can but for example if you pick the provider you might trust the provider maybe in the city where you live for example to keep your data secure but there is a subset of your data let's say I don't know copies of your passport your driver's license another data that you know you want to really be sure that it stays only yours now of course then you can just not put it in next cloud but maybe you still want to sync it between your laptop and your desktop and your mobile phone this is essentially the use case for the end to end encryption so even if you know your server gets fully compromised data that is put in a folder that is end to end encrypted should not be accessible by the people who controls the server now or if you're a company and you know you have financial data that you need to release to your investors once a year you want to make sure that no system admin thinks gosh I'm going to earn a little bit extra you know by betting on the stock market using this data put in an end to end encrypted folder and only the financial team can get at it that's the use case and that is what we designed this to protect from yeah and the second element that is really central to the end to end encryption is ease of use it should be simple because the biggest issue of security is always the user right it's always the user that's the weakest link so if it is not easy to use people are going to make mistakes and if they make mistakes the security isn't worth much as an example if you let users pick their own password for the end to end encryption they will probably pick the same password that they use for next load in the first place that password is obviously already on the next slot server otherwise how can you log in and that goes your additional security how are they pick the name of the spouse or something else so as one example we designed it so that users don't pick their own password we give them one and there are many other areas where you make choices like these so aside from these you know two basic things protect from the server and be easy to use the other properties that we wanted in our end to end encryption were these sharing should be easy but completely secure it needed to provide confidentiality integrity and authenticity that is authenticity that if somebody shares a file with you that you know it from that person so somebody else come in impersonate them second of all it needs to protect the integrity so the server who has access to all the files even though they're encrypted should not be able to fiddle with the encrypted files and change them that way yeah that should just be blocked or not work of course a server could delete some of the files and in that case the user should be warned but a server should never be able to modify any of the data that you get and last but not least confidentiality I mean the obvious thing the server should never be able to read the data or anyone else in between the recipient and the sender now we wanted to do all this using standard libraries rule number one in crypto is don't build your own crypto so we wanted to use well tested and audited libraries for all of this so we've used libraries that needed to be available on the platforms we support so that's iOS, Android, Windows, Mac and Linux as well as PHP because that's what our server is built in and we don't really plan on providing a web interface for this because well you know if you don't trust a server you can't trust code that comes from the server either so it doesn't make much sense to the decrypt on the server but maybe there will be a use case for that at some point we don't know yet we want to keep our options open and I'm talking about the design here so it needs to be supported if possible we wanted to have a recovery option because well base thought behind this is we assume the users make mistakes the system administrator on the other hand in our design we assume the system administrator knows what he or she is doing might not always be the case but that's at least how we designed it so it makes sense to have an optional recovery option obviously you should warn users when it's enabled and if you enable the recovery option it shouldn't be possible to get access to the data that you uploaded before the recovery was enabled otherwise you just made a backdoor so that's another thing we wanted to have a dose if you have a company and you know an employee leaves you still want to be able to get at their data and that's one of the use cases where you need a recovery option well obviously it need to be multi-device so you need to be able to get your files from a desktop to your laptop and to your mobile phone without the server getting access to it and we wanted to have versioning built-in so that if we develop a new version of the protocol you know that it doesn't break the old one so that if we have changes improvements we can actually do that like new encryption algorithms things like that the downside of all of it is we accept some feature loss so the most obvious thing that you lose is all the stuff that's done by the server so versioning of files and next cloud is done by the server you lose it trash done by the server you lose it online editing of files well no surprise you lose it previews in the web interface again you lose this another thing is the way we designed it is we want to share on a folder level so not on an individual file we can only share a folder with other people you can have multiple folders but you can't share a single file in the folder you share at the top level and the last thing that we accepted as a feature loss is sharing to groups so right now it's not possible to share to groups with theirs only to individual users all obviously multiple but it's individual right so I'm now going to go into the details of what we have designed and again if you have questions or want me to clarify it because you know I might go too quick or too slow please you know tell me so I'm gonna go start with the creating an identity right so to set it up initially you create a key or a key pair a private public key pair generate it sign it encrypt it etc so I'm gonna start with that so first part essentially the initialization what you do is the client use you turn on enter an encryption and it creates a public private key pair on the device then it requests a certificate from the server for the private and public key and it uploads the public key to the server this if other people share with you they share to this public key checking the certificate with it that's how we kind of protect your identity for other people give me a second so the private key is then stored on the device on your laptop or mobile phone let's say you're using your laptop for this that is then where this key is stored yeah so next we want this private key to be on your mobile phone as well obviously we can't just upload it to the server because we don't trust the server so what we do instead is we encrypt the private key with a 12-word mnemonic essentially a passphrase we pick those 12 words randomly out of a dictionary of 5,000 words that are at least five characters long so you get a pretty damn long password that should keep it secure when it's encrypted with that we upload it to the server and we show these 12 words to the user and we tell the user please write this down somewhere now you might remember that I said we assume the user you know isn't terribly competent so we also assume that they don't write it down and we store it in the keychain so the 12 words are on the device as well in case the user doesn't write it down which a lot of them won't next step so what we've done now is we have on the server your private key which is encrypted with a 12 word mnemonic which you only have on the device and on a piece of paper if you wrote it down and we have the public key and both of them are protected with the certificate as in you can verify the certificate for them yeah so your mobile phone which you now also initialize will download the public and private key from the server it will check the certificates trust on first use is what we use here and then it will ask you for the mnemonic to decrypt the private key so well either you take it from what you wrote down or you look on your laptop and you say please show me the mnemonic and then you enter the mnemonic on your mobile phone it decrypts the private key stores it in the keychain also stores the mnemonic in the keychain so that if you lose your laptop and you need to reinitialize it you can use your mobile phone and done we now have our public and private key on both devices and the server never saw anything so now we're essentially up and running I'm sorry I should have switched earlier so now we're essentially up and running we can encrypt and decrypt files so let's talk about how we do that so we're gonna create an end to an encrypted folder we're gonna put some files in it we're gonna get them you know from another device until well that's how you use it at least between devices so step one so we create a folder and you right-click on it or you use on your mobile phone you click and you make it end-to-end encrypted at this point your device will create a metadata file to protect the contents in the metadata file it creates a metadata file key yeah now this key is encrypted to all the public keys that need to have access to the folder now so later on if you share the folder what will happen is that the metadata key will get re-encrypted to all those people so they have access all the contents of the metadata file are encrypted with this key we upload the whole stuff to the server and next step so now we want the other file what we do is we generate 128 bit key use it to encrypt the file and then put the file name and the key in the metadata file remember encrypted by the metadata key we generate a random identifier for the file which is now encrypted we upload the file to the server we then upload the encrypted metadata to the server and we're done now the server now has an encrypted file with a random file name and it has a metadata file which is encrypted but contains the name of the file and the key that was used to encrypt the file so then the next step is your mobile phone will download the folder download the metadata use your usage private key to decrypt the metadata key use the metadata key to decrypt the data in the metadata file which will then include the file name and the uuid of the file it will then download the file decrypt the file using the file key from the file and you have your data now on two devices without the server having had a chance to get to see what you were doing so that's step two we now can get files from one device to the next next step sharing with other people and un-sharing this is also the last step so to share with somebody you download their public key from the server you verify their identity using the certificate and again trust on first use you store the certificate and their public key locally on the device so if it changes somebody tries to impersonate them you will refuse that and you will not you know share files with somebody who isn't the person that you initially shared with then well simple you re-encrypt the file metadata key to the new person you want to share with to their public key and then you essentially upload the metadata again and you tell next slide via the OCS API I want to share with this person and then the other person can download the file and use their private key to decrypt it or the whole folder actually not not just the file and to un-share you remove the file metadata key you create a new one you encrypt that new file metadata key against the public keys of the older people who need to have access minus the person you want to un-share with and you upload the new metadata file again and then you use the OCS API to essentially remove the sharing that you had this means that that person still has access to the old files but that's kind of obvious I mean if I show you a piece of paper then I can take the paper away but I can't tell you to forget what you saw so it's the same mechanism here and this is essentially it this is the way we have designed our end-to-end encryption the server facilitates it stores private and public keys it takes care of the sharing it helps the devices work with each other but it never ever gets access to plain text content so as I said a few times now we kind of expect users to be a little incompetent so of course at some point they will you know lose the key in the sense that they don't use you don't know the mnemonic anymore had a 12 words now if you don't know the 12 words any of your devices can show you the 12 words because they all stored it in the local key store yeah so your laptop your desktop your tablet your mobile phone they all can show you the 12 words that you need to initialize a new file download your private key unencrypted and you can share again with other people but if you're safe exploded your laptop fell in the toilet your mobile phone fell out of the window your tablet was ruined by your cousin and well what happens to your desktop I guess your house burned down there is a point where you don't have this mnemonic anymore so don't do that because we don't have a backup for that add that stood it otherwise we can't secure your data however if your server administrator has enabled the recovery key you can at least get your data back you can't get your private key back your identity is essentially burned we can get your data back so the way the recovery key works is a when a system administrator enables this on the server all the users will get a warning that the recovery key has been enabled so that they know that there's kind of a backdoor now to their data and a new private public key pair is generated on the server with a certificate and all users will from then on encrypt their data to the public key of the server so that the private key of the server can decrypt their data this private key is stored on the server but obviously not unencrypted because otherwise what are you protecting against so it is encrypted with guess what the 12 word mnemonic this is shown to the system administrator once he or she needs to write it down and ideally put it in a safe literally and physically I mean and after that is wiped because it's not stored on the server because that would be you know keeping your keys lying on top of the safe so what this means that if somebody hacks an excellent server with an enabled recovery key they still have no access to anybody's data they would still need a 12 word mnemonic which should be safely in a safe managed by the system administrator but if one of the employees leaves the company or if one of the users loses all their devices and you know has their safe burned down they will be able to go to the system administrator and say please give me my files back and the system administrator can enter the 12 word mnemonic an excellent server can decrypt the data give this back and then again wipe the mnemonic from the server memory and storage so you have kind of an ultimate backup now in our design we also have a third option which is to create a new identity for the user using a hardware security module this part isn't really implemented yet but we've tried to design it in a way that this is an alternative and for big companies they will perhaps use that to create new identities for users but is yeah so you might wonder where can I download it so right now the server side is done right it can well it stores the public and private keys it can facilitate the sharing it can you know deal with encrypted files and recognize them and not try to generate thumbnails out of it and these things this is done the Android app can you know create a secure identity send it to the server sync it from another device upload and download files this works same with the iOS client the desktop client right now can create a secure identity sync it with the server create a folder make it enter an encrypted and upload files it can't download yet that's the last thing that needs to be finished as soon as that is done and we've tested it all a bit more we will release it when we'll see and of course all the code is online it's all fully open source so please go look at it also at the design the way I just described it to you go through the code check if we made any mistakes because that's actually bloody important right this is why we do it open source we have smart people look at it yeah and comment on our you know RFC our whole design if you see holes if you have any questions you can also ask them now obviously I guess you should get a microphone but you can get mine here okay I was wondering that the ways with the recovery key that the administrator has the the password from it's a 12 word phrase what if the administrator just remembers it when it's in the safe then the administrator can use it wouldn't it be better to do something that then is very hard to remember for human like maybe print out a barcode and on a piece of paper put it in a safe or something like that yeah so the basic thought behind this was as I said before we kind of assume a competent system administrator and in that I guess we kind of assume we trust him or her as well I mean I think in a lot of bigger companies especially you would let the head of IT do this or something like that and not all the whole sis admin team would not know the 12 words but just one person I mean at some point there has to be a point of trust so it will be possible I mean we could make it a 60 words I mean good luck remembering that I mean I know there are people but something like that will be possible I suppose yeah yeah I was just thinking that actually with the barcode scenario that like the whole team could come printed out put it in the safe everybody has seen that it's in the safe and everybody knows that nobody knows it's a barcode yeah I hope they and cannot remember about code but they just looking would absolutely be possible in the design I mean it's not married or limited to a 12 word passcode this what we picked but yeah actually I think on the mobile site I'm not sure we have it yet but the idea on the mobile site would definitely be that you can instead of showing the mnemonic you would show a barcode that you can then scan with your phone to art so that you don't have to type the 12 words is definitely something we thought about I just I don't think it's implemented yet but it's possible so then it should be possible on the site too right yeah hello yeah another question thanks for the talk very inspiring I use next cloud personally so thank you one this might sound like criticism so but you started a talk with don't invent new crypto yes but yet the scheme that you described seems to be very like invented new crypto could you well with crypto I mean we don't invent our own crypto algorithms or anything like that obviously the scheme itself I mean it's inspired by a bunch of things including our own server side encryption which we developed quite some years ago but yeah to do this in a secure way you have to come up with a scheme right because the requirements are always different so maybe this will make it easier to answer where why didn't you use something like open pgp or CMS that is a standard for encrypting files stored files it wouldn't satisfy the requirements as I laid them out in my first slides okay so let's follow up on that I think it's possible but another question what if the 12 word is leaked or if you happen to paste it in some IRC channel or something what do you do then your private key is compromised that's like sharing you know the password for your PGP key at that point you're lost and so you would need a hardware security module or a new certificate authority kind of solution to be able to generate a new identity yeah I think that's that will be the only solution for that so yeah don't but of course you only need it when you are the new device right this is a very rare like you are the new laptop or a new mobile phone I don't know once a year twice a year so aside from the moment when you set this up when your laptop your desktop in your phone you don't pretty much ever need to think about passwords or write anything done because it's all done via the public private keys there's no need to enter passwords on anything other than adding a device which is the least common thing that you do I think with crypto like this but but I guess I mean I said common scenario will be that one of your devices is compromised and that key will be leaked yes that is a risk and at that point the mnemonic is in the in the storage of the device essentially this for us is out of scope I mean the idea is to not trust the server if you can't trust your devices either it's kind of you know hard for us so you should have an locally encrypted storage on your device and keychains are usually encrypted so yeah again for us it's out of scope but there are of course ways to protect your devices from harmful effects of being stolen quick question the the passphrase for the recovery is it once per installation or is it one for every user now it's one per installation so every user will then encrypt to the public private key pair or well to the public key of the server so the server has a you know has a recovery key yeah yeah it's essentially technically it's not a user right the server user yeah yes hello I had another question what happens when you as a user when your certificate expires oh I'm guessing we we would give a infinite like no expiry certificate yeah because the user identities are as I said trust of first use and you can never change them all right it's kind of inherent to the concept and the only way to change them as I said is using the using a hardware security module or a certificate authority and of course if you have a certificate authority that you trust then obviously you could put a time to live time to end on certificates if you want so if it would expire would I have to re-encrypt everything well your public and private key pair were encrypted with it so I guess yes yeah you would get a new identity no well certainly not all your files because this whole thing is designed that you never need to re-encrypt your files as you might metadata might not yeah exactly it's just a metadata file so when you share a folder you don't need to re-encrypt and then re-upload all the files the only thing you need to re-encrypt and re-upload is the key to the metadata file right so when you share a folder of 600 gigabyte of data your upload is five kilobytes all right that's the nice thing about the way it's designed and if you would have encrypted the files with PGP or something like that that uses a public key and you want to make it available to other people what do you do you have to re-upload all of them again and that's of course not nice to put it mildly okay so I was late so sorry if you already told this but I was wondering about the 8 word that the user has to write down why you pick it directly from a dictionary and not let the the user put it cause of course if you take it from a dictionary the dictionary is the dictionary that someone can use for brute force the account well we picked a dictionary with 3,000 words good luck brute forcing it I mean sure if you let the user pick passwords though I mean we all know what they do right name of dog name of cat name of wife name of husband name of the kids and there we have 12 words that is very easy to brute force so we explicitly do not let the user pick their own passwords because users are again our model assumes the user is dumb the system administrator knows what he's doing but the system of compromised that is kind of the base tree tenants of how we designed it I mean there's no right or wrong way here right it's just what do you what were your assumptions when you designed it and these are our assumptions and maybe I missed it but how do you verify the integrity of the files in your scheme so the files are encrypted with key I have to look up the exact type of key I'm not deep into that technical side of things the 128 bit AES GCM no padding and obviously if the file has been changed in any way well this won't work you can't decrypt it I think I understand it's a property of this algorithm that if you make any changes then you know you'll get garbage or warning or at least a way to detect that again I would have to check that with a techie how this works exactly and the other part is of course you know who shared it with you otherwise your public you check this on the certificate so the certificates make sure the check the authenticity and the integrity has to be protected by the algorithm and some of this is already like a couple of months old so it might be that we've picked another algorithm that does a better job at this but there are no other details I guess that you can disable users can you also revoke keys or certificates I don't think so obviously a server you can simply stop handing them out to an client ask for them that should do the trick in practice because obviously you know if you share with somebody you first have to download their public key from the server to be able to share with them and if that doesn't exist then you can't share on the other hand once you have shared the other person will store your information in their keychain and as long as a server gives them data they will be able to decrypt it until you re-encrypt the metadata key of course we are in practice you would remove the person from the server and then they can't sync with the server and yeah it's game over at that point I mean we try to rely on the existing sharing and user handling mechanisms in next cloud as much as possible because you know they work they scale they're reliable they've proven themselves so yeah how do you deal with changing files do you just take it as a new one like if I edit the file yeah so if you edit the file the file is essentially encrypted with a new key so a new key is generated for the file that is then used to encrypt the file and upload it again but does it use the same metadata no at that point you also need to regenerate the metadata file put the new key in there etc and so if I share something it's I only share this version no as long as people have access to the metadata they will simply download new versions of the file decrypt the metadata I use that to decrypt the file and they get new versions of the file as well and there's change detection built into next cloud server so they will get if they use a sync client they'll simply get the latest version okay so use you use the same metadata keys until you decide that you know one person in the list doesn't have access anymore at that point you change the metadata key so you cycle through metadata keys but only when it's necessary if you change the access rights all right and grill him as long as he's on the stage grill him shit how much time do I have left just a question about the mnemonic you use a 3000 word dictionary I believe so but don't shoot me I might be wrong because it reminded me a lot at the Bitcoin or in cryptocurrency used sheen which uses I think a 4000 word dictionary so I was wondering don't you use the same and why don't you use the same I don't know I know I have to look up the detail of exactly what dictionary it is but it's a pretty standard 3000 word English dictionary the design doesn't depend on it in any way I mean you could also take a 6000 words you can do it in Greek if you want it's just more people can write 12 English words than 12 Greek words okay I just want to point out the advantages of this because it's a proven sheen and it's yes identically available in different languages and it also includes and that's a question a checksum like the the last half of the last word is a checksum over the whole thing do you have these two like can you tell the user if it's no mnemonic is right around exactly I can get you the answer if you like is I think we picked a you know like we didn't make our own dictionary I know we picked it from somewhere and I'm going to guess there was some thought put in that but I don't know the thoughts behind that thanks can I give you the microphone hello do you have any next cloud stickers seriously though and I'm not a great coder and I just want to ask what other ways can people get involved or contribute to the project so if you have any other or if you could maybe give an idea of the project and how people can contribute well there are obviously a lot of ways to contribute aside from coding and reviewing stuff like this and asking difficult questions about it well that's the usual I guess documentation but also like promo marketing and telling other people about it that's I think every open source project benefit from that honestly I think just helping other users is really important because a lot of people asking questions on our forums trying to get help it's on help.nextcloud.com and if you run the next cloud server you know a little bit how and what of it it's really appreciated if you especially if you use the forum sometimes to get answers to your own questions please help answer a couple of questions there if you happen to know them because that really helps I think the community as a whole forward so I hope that suffices as some inspiration anyone else questions I'm excused no more then I will have the last question did Josh go ahead what's your password well it's a 12 word mnemonic and I don't remember that's terrible don't okay applause to Josh