3 ms·

Out of curiosity, how can end-to-end encryption be verified when both the clients and the servers are closed-source?

• Hnrobert42 6y ago
  How can you know it’s not E2EE? The absence of evidence is not the evidence of absence, or something like that. I agree that closed source is harder to verify, but that’s not the same as insecure.
  • anoncake 6y ago
    If you can't verify your messages are E2EE, you have to trust the vendor. But if you trust the vendor, you don't need E2EE to begin with.
    • Hnrobert42 6y ago
      There are other threat actors than the vendor looking to compromise the confidentiality of your message.
      • anoncake 6y ago
        Those actors don't have the vendor's encryption keys.