3 ms·

What is the benefit of end to end encryption in this scenario? There is no risk of service provider spying on you because you as the business is the service pr

by maxloh 4y ago

What is the benefit of end to end encryption in this scenario? There is no risk of service provider spying on you because you as the business is the service provider.

jeroenhd 4y ago
This is part of a hosted package. In theory, this means that the folks over at Element.io can't see the chats between you and your customers/business partners because of the E2EE. That does depend on them not hosting the software, of course, because E2EE becomes useless if the software used to encrypt data can be changed at a whim. With the private keys on the recipient end and the browser end, it does make it easier to follow certain data privacy regulations. Whether the rather leaky Matrix protocol is considered foolproof is still an unanswered question, though; the average encrypted chat session sends a LOT of unique identifiers that shouldn't cause any trouble, but I haven't seen a recent audit of the protocol.
tcfhgj 4y ago
Hmm, I'd say it depends. Imagine you're contacting a doctor and are communicating about sensitive stuff. I'd still expect this to been treated relatively confidential, i.e. not spreading it within the company, or potentially leaking it. Plus, the matrix server of the person on the other side might not be in your hands, e.g. hosted by Element
hda2 4y ago
E2EE can prevent the leaking of private conversations to thirdparty middleware/cloud companies. This would allow orgs to continue using those thirdparty services to handle their traffic like usual, but would also guard against middleware disasters like cloudflair's leaking of https traffic. Thanks to the prevalence of early HTTPS termination (usually at the edge of some big cloud company), that green pad lock at the top of your browser means little when true privacy is needed.
viccuad 4y ago
In addition to points from others: no middleman can tamper with the information being sent (e.g: see how Russia changes content of pages served via http to display war propaganda or ads).
- maxloh 4y ago
  How did that work with HTTPS?
godelski 4y ago
> What is the benefit of end to end encryption in this scenario? Let's say I'm talking to my bank. Is there really any information that you want open? They're going to ask you security questions to confirm your identity. You're likely talking about specific sums of money. Let's say you're talking to your doctor. Is there really any information that you want open? Are you violating HIPPA and privacy laws just by talking? Your health is of no concern to anyone but you and your health provider. Full stop. I mean, they use these two examples in the post. The use case is pretty clear to me here. The risk isn't your service provider spying on you, it is anyone that you aren't intending to talk to. A hacker (who may be interested in your bank or health care). A state actor. Abusive ex. Data companies that extract every bit of information they can. Or politicians who want to track your period. Maybe this isn't useful when I'm submitting tickets to wandb, but I can see this being very helpful when I'm talking to my bank.

by maxloh 4y ago

What is the benefit of end to end encryption in this scenario? There is no risk of service provider spying on you because you as the business is the service provider.

jeroenhd 4y ago

This is part of a hosted package. In theory, this means that the folks over at Element.io can't see the chats between you and your customers/business partners because of the E2EE. That does depend on them not hosting the software, of course, because E2EE becomes useless if the software used to encrypt data can be changed at a whim. With the private keys on the recipient end and the browser end, it does make it easier to follow certain data privacy regulations. Whether the rather leaky Matrix protocol is considered foolproof is still an unanswered question, though; the average encrypted chat session sends a LOT of unique identifiers that shouldn't cause any trouble, but I haven't seen a recent audit of the protocol.

tcfhgj 4y ago

Hmm, I'd say it depends. Imagine you're contacting a doctor and are communicating about sensitive stuff. I'd still expect this to been treated relatively confidential, i.e. not spreading it within the company, or potentially leaking it. Plus, the matrix server of the person on the other side might not be in your hands, e.g. hosted by Element

hda2 4y ago

E2EE can prevent the leaking of private conversations to thirdparty middleware/cloud companies. This would allow orgs to continue using those thirdparty services to handle their traffic like usual, but would also guard against middleware disasters like cloudflair's leaking of https traffic. Thanks to the prevalence of early HTTPS termination (usually at the edge of some big cloud company), that green pad lock at the top of your browser means little when true privacy is needed.

viccuad 4y ago

In addition to points from others: no middleman can tamper with the information being sent (e.g: see how Russia changes content of pages served via http to display war propaganda or ads).

maxloh 4y ago
How did that work with HTTPS?

godelski 4y ago

> What is the benefit of end to end encryption in this scenario? Let's say I'm talking to my bank. Is there really any information that you want open? They're going to ask you security questions to confirm your identity. You're likely talking about specific sums of money. Let's say you're talking to your doctor. Is there really any information that you want open? Are you violating HIPPA and privacy laws just by talking? Your health is of no concern to anyone but you and your health provider. Full stop. I mean, they use these two examples in the post. The use case is pretty clear to me here. The risk isn't your service provider spying on you, it is anyone that you aren't intending to talk to. A hacker (who may be interested in your bank or health care). A state actor. Abusive ex. Data companies that extract every bit of information they can. Or politicians who want to track your period. Maybe this isn't useful when I'm submitting tickets to wandb, but I can see this being very helpful when I'm talking to my bank.