{"id":50309,"date":"2025-12-04T21:42:04","date_gmt":"2025-12-05T02:42:04","guid":{"rendered":"https:\/\/mjtsai.com\/blog\/?p=50309"},"modified":"2025-12-05T11:00:43","modified_gmt":"2025-12-05T16:00:43","slug":"end-to-end-encrypted","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2025\/12\/04\/end-to-end-encrypted\/","title":{"rendered":"“End-to-End Encrypted”"},"content":{"rendered":"

Simon Fondrie-Teitler<\/a> (Hacker News<\/a>, Slashdot<\/a>):<\/p>\n

In October Kohler launched Dekota, a $600 (plus monthly subscription) device that attaches to the rim of your toilet and collects images and data from inside, promising to track and provide insights on gut health, hydration, and more. To allay the obvious privacy concerns, the company emphasizes the sensors are only pointed down, into the bowl, and assures potential buyers that the data collected by the device and app are protected with “end-to-end encryption”.<\/p>

Kohler Health’s homepage<\/a>, the page for the Kohler Health App<\/a>, and a support page<\/a> all use the term “end-to-end encryption” to describe the protection the app provides for data. Many<\/a> media<\/a> outlets<\/a> included the claim in their articles covering the launch of the product.<\/p>

However, responses from the company make it clear that—contrary to common understanding of the term—Kohler is able to access data collected by the device and associated application. Additionally, the company states that the data collected by the device and app may be used to train AI models.<\/p><\/blockquote>\n

E2EE has become a marketing term, and I no longer believe it unless the company also provides a technical description of what they mean by it. For over a decade—before iCloud Advanced Data Protection—Apple marketed iMessage as being E2EE. This was technically true, because the protocol<\/em> was E2EE, but in practice the system<\/em> was not E2EE because Apple had access to the key (in the iCloud backup). In Kohler’s case, there seems to be nothing<\/em> that’s actually E2EE. It’s “simply HTTPS encryption,” combined with “technical safeguards and governance controls.”<\/p>\n\n

Previously:<\/p>\n