3 ms·
> That still does not change anything though. Of course it does. Just like PGP works fine over untrusted channels - like if I posted a gnupg ascii-armored mess
by e12e 3y ago
> That still does not change anything though.
Of course it does. Just like PGP works fine over untrusted channels - like if I posted a gnupg ascii-armored message here.
e2ee makes all the difference - if two trusted and mutually authenticated clients are communicating with proper e2ee - the best an attacker can do is traffic analysis and denial of service...?
- hutzlibu 3y ago"the best an attacker can do is traffic analysis and denial of service...? " That's already a lot. If the evil secret police knows when and with whom you texted, then they don't even need to know the text of the messages, to link you to the opposition. And then just extract you and then the password with force to get the rest.
- DoctorOW 3y agoRelevant: https://xkcd.com/538/ https://xkcd.com/538/
- hutzlibu 3y agoIt is, but encryption is still useful, as not everyone on this planet is in reach of evil secret police and their goons and wrenches are limited.
- e12e 3y agoIt certainly is a lot. It's enough for a drone strike. But almost by definition, if you have a back-end, there will be meta-data. There's been a few attempts at getting around it, with "one-to-many" (eg opaque PGP posts to Usenet groups), Mixmasters (remailers) or onion routing. None are AFAIK truly practical with a state-level adversary. e2ee is a good start, that doesn't mean you don't need to analyse the risks.