3 ms·

How is this even a question? If you want E2E encryption, you sacrifice good full-text search, because you have to build the index on a computer that has access

How is this even a question? If you want E2E encryption, you sacrifice good full-text search, because you have to build the index on a computer that has access to the plaintext, which means doing it on an endpoint. It’s not as nice as doing it on the server. If you want to hide metadata, the state of the art is onion routing, and that adds a lot of latency. The only other way that’s even been attempted is Enclave computing, which basically just moves the trust from the service operator to the enclave vendor. Enclave computing is better than nothing, but it belongs in a defense-in-depth approach, not a privacy strategy in itself. And if you want to avoid fingerprinting, you lose responsive design. Those two things are just directly in conflict here.

feanaro 4y ago
> If you want E2E encryption, you sacrifice good full-text search, because you have to build the index on a computer that has access to the plaintext, which means doing it on an endpoint. It’s not as nice as doing it on the server. I'd argue it's better than on the server. Bring me back local computing, please. It's more private, more performant and more energy efficient. The attempt to centralize computing into central server nodes is not reasonable.
nobodyandproud 4y ago
I'd say it's probably the single most important question. Engineering is about trade-offs; understanding which trade-offs are acceptable means understanding what it is you're trying to solve; then assessing whether the problem is being looked at from the correct point-of-view (and for that matter whether it's even a technical one). For example: Journalists within hostile nations are risking their lives every day. Because of this, they're keen on keeping their communication private and away from prying eyes. So far, the compromises largely involve zero-days and social engineering. The former is really due to the shaky foundation of software today. Every single best practice I see is just awful. Whereas social engineering is an on-going problem and is a policy/procedural/cultural problem, not a technical one. The union of bad software and tolerant social protocols make privacy difficult. Going back to your objection: For use cases where your life is on the line, is a few seconds or even minutes of latency really a problem? Extend the question, for cases where it's not life-threatening but life-altering. What trade-offs are most users willing to make then? If you're not willing to make any trade-offs no matter what, then it's difficult or even impossible; and also a sign of a poor engineering process.

feanaro 4y ago

> If you want E2E encryption, you sacrifice good full-text search, because you have to build the index on a computer that has access to the plaintext, which means doing it on an endpoint. It’s not as nice as doing it on the server. I'd argue it's better than on the server. Bring me back local computing, please. It's more private, more performant and more energy efficient. The attempt to centralize computing into central server nodes is not reasonable.

nobodyandproud 4y ago

I'd say it's probably the single most important question. Engineering is about trade-offs; understanding which trade-offs are acceptable means understanding what it is you're trying to solve; then assessing whether the problem is being looked at from the correct point-of-view (and for that matter whether it's even a technical one). For example: Journalists within hostile nations are risking their lives every day. Because of this, they're keen on keeping their communication private and away from prying eyes. So far, the compromises largely involve zero-days and social engineering. The former is really due to the shaky foundation of software today. Every single best practice I see is just awful. Whereas social engineering is an on-going problem and is a policy/procedural/cultural problem, not a technical one. The union of bad software and tolerant social protocols make privacy difficult. Going back to your objection: For use cases where your life is on the line, is a few seconds or even minutes of latency really a problem? Extend the question, for cases where it's not life-threatening but life-altering. What trade-offs are most users willing to make then? If you're not willing to make any trade-offs no matter what, then it's difficult or even impossible; and also a sign of a poor engineering process.