4 ms·

> Oh again this obsession with e2ee This is a post on the Signal blog. They are obsessed with E2E encryption, and will never be talked down from it. Also, I p

> Oh again this obsession with e2ee This is a post on the Signal blog. They are obsessed with E2E encryption, and will never be talked down from it. Also, I presented several problems with email, not just poor support for encryption. > Email can be e2e encrypted easily if you want it. E2E encryption should have forward secrecy. The way that’s usually implemented requires “handshake” messages to be exchanged before the payload is sent anywhere, which cannot be easily retrofitted onto PGP (adding it would be less “encrypted email” and more “an entirely different communication protocol, tunneled over SMTP”). The Axolotl ratchet that Signal uses requires the key for a communication channel to change over time, which is also pretty far away from what PGP and S/MIME currently do. > The fact is that you generally don't, because you want to access your mail from any device and you want a server-side search Signal and WhatsApp both exist and people use them, so they obviously aren’t deal-breakers. > Also, proper e2ee requires identity verification of your contacts, where you check their key fingerprints using an uncompromised channel It requires you to verify the identity of one, initial contact to bootstrap your social network. From then on, the “uncompromised channel” can be the previous E2E encrypted channel you already created.

Andrew_nenakhov 5y ago
> This is a post on the Signal blog. I'm not responding to a person who writes the Signal blog. I'm arguing with a silly statement 'but but email doesn't have e2ee'. Spam problem is big, and can be solved in other federated protocol like XMPP by requirement to authenticate sender before sending a message. > E2E encryption should have forward secrecy. That is an arbitrary requirement imposed by you just now. For many people it absolutely SHOULD NOT have forward secrecy, and a message signed by a public trusted key would be much better. Regarding that 'axolotl ratched', my developers have implemented it on at least 2 platforms, that protocol can absolutely be ported to email. But nobody will do it because in practice nobody really needs it, just some obsessed nerds. > Signal and WhatsApp both exist and people use them, so they obviously aren’t deal-breakers. ... And Telegram CRUSHES them with BY FAR superior user experience precisely because they DON'T have e2ee for regular chats. > It requires you to verify the identity of one, initial contact to bootstrap your social network. No, this is a security theater again. If you need e2ee you should not trust someone else to do a verification work for you. Not your contacts, not a Signal's CA, nobody. Imagine you are a gangster in a sinister organization. All it would take to compromise your communications is just one mole coerced to work with the police. And if you aren't willing to do this work because it is too burdensome, you should honestly face the fact that nobody is interested in your communications, and that your insistence on e2ee does not, in fact, increase your privacy, but just makes you feel more safe.
kitkat_new 5y ago
> E2E encryption should have forward secrecy. Curios, why? What scenarios does PFS protect you from exactly?
- tialaramex 5y ago
  Any scenario where the keys are now in unfriendly hands, without PFS they now get to read any previous data encrypted with those keys, for example because they've snooped the encrypted data and been keeping it for just such an opportunity.
  - Andrew_nenakhov 5y ago
    just a day or two ago some Matrix fan here proudly told me how great e2ee is implemented in matrix that they encode all data on a server with your current password. So first you implement an e2ee protocol with PFS, then make a hole in your security to make using it a little less inconvenient. Good job!
    - kitkat_new 5y ago
      > just a day or two ago some Matrix fan here proudly told me how great e2ee is implemented in matrix that they encode all data on a server with your current password. Matrix doesn't encode all data on the server with your current password. Messages are encrypted through keys according to MEGOLM. If the user chooses keys can be encrypted using a security key either generated randomly or derived from a password.

Andrew_nenakhov 5y ago

> This is a post on the Signal blog. I'm not responding to a person who writes the Signal blog. I'm arguing with a silly statement 'but but email doesn't have e2ee'. Spam problem is big, and can be solved in other federated protocol like XMPP by requirement to authenticate sender before sending a message. > E2E encryption should have forward secrecy. That is an arbitrary requirement imposed by you just now. For many people it absolutely SHOULD NOT have forward secrecy, and a message signed by a public trusted key would be much better. Regarding that 'axolotl ratched', my developers have implemented it on at least 2 platforms, that protocol can absolutely be ported to email. But nobody will do it because in practice nobody really needs it, just some obsessed nerds. > Signal and WhatsApp both exist and people use them, so they obviously aren’t deal-breakers. ... And Telegram CRUSHES them with BY FAR superior user experience precisely because they DON'T have e2ee for regular chats. > It requires you to verify the identity of one, initial contact to bootstrap your social network. No, this is a security theater again. If you need e2ee you should not trust someone else to do a verification work for you. Not your contacts, not a Signal's CA, nobody. Imagine you are a gangster in a sinister organization. All it would take to compromise your communications is just one mole coerced to work with the police. And if you aren't willing to do this work because it is too burdensome, you should honestly face the fact that nobody is interested in your communications, and that your insistence on e2ee does not, in fact, increase your privacy, but just makes you feel more safe.

kitkat_new 5y ago

> E2E encryption should have forward secrecy. Curios, why? What scenarios does PFS protect you from exactly?

tialaramex 5y ago
Any scenario where the keys are now in unfriendly hands, without PFS they now get to read any previous data encrypted with those keys, for example because they've snooped the encrypted data and been keeping it for just such an opportunity.
- Andrew_nenakhov 5y ago
  just a day or two ago some Matrix fan here proudly told me how great e2ee is implemented in matrix that they encode all data on a server with your current password. So first you implement an e2ee protocol with PFS, then make a hole in your security to make using it a little less inconvenient. Good job!
  - kitkat_new 5y ago
    > just a day or two ago some Matrix fan here proudly told me how great e2ee is implemented in matrix that they encode all data on a server with your current password. Matrix doesn't encode all data on the server with your current password. Messages are encrypted through keys according to MEGOLM. If the user chooses keys can be encrypted using a security key either generated randomly or derived from a password.