4 ms·
You can't invent your own definition of end-to-end encryption. There is a material difference between a service which end-to-end encrypts your files – even if i
by feross 6y ago
You can't invent your own definition of end-to-end encryption. There is a material difference between a service which end-to-end encrypts your files – even if it sends you the code to do so – and one which does not.
When a user logs into 1Password.com, they're using end-to-end encryption. The master password and secret key never leave the browser. The server never receives the key and therefore does not have a way to access the contents of password vaults.
This is very different from an application which, by design, sends your plaintext data to remote servers.
The English phrase we use to describe this difference is "end-to-end encryption".
- tptacek 6y agoI have not in fact invented my own definition of end-to-end encryption, and yours is not the first application --- nor is browser crypto the only cryptography setting --- that has tried to claim "end-to-end security" for a design where both ends implicitly trust the server.