4 ms·
I never understood what problem E2E encryption actually solves if you don't have full control over the client. All it would take Signal or WhatsApp to extract a
by ThePhysicist 6y ago
I never understood what problem E2E encryption actually solves if you don't have full control over the client. All it would take Signal or WhatsApp to extract all your private messages is a single update of the client, which is trivial to do and currently very hard to validate as e.g. Apple does not even (to my knowledge) provide checksums to end users.
The problem of messaging as it is today is that we missed the opportunity to create a well-accepted federated protocol that can be implemented easily. There were a few contenders like IRC but they never reached a critical mass like SMTP or IMAP did. Maybe Matrix can fix this, but I don't have much hope we'll turn away from WhatsApp anytime soon, 95 % of users don't care enough to change and the lock-in effects are enormous at this point. The only way that this situation could be resolved is through legislation, e.g. the EU forcing WhatsApp to implement the Matrix protocol and make their infrastructure interoperable with third-party providers, but even that seems quite far-fetched right now.
In any case, having a non-profit like the Signal foundation run a messenger is already a vast improvement over a company that sees this mostly as a data mining operation.
- Mediterraneo10 6y agoSignal’s Android client moved to reproducible builds some time ago already.
- dublinben 6y ago>what problem E2E encryption actually solves Pervasive, passive surveillance. If your threat model includes individually targeted exploits, then you'll need to look for other solutions.
- ThePhysicist 6y agoYou don't need E2E encryption for that, transport layer encryption will do just fine in that case.
- growse 6y agoThe transport between where and where?