3 ms·
E2EE is only truly reliable if you control the endpoints fully, and verify keys. Short of that is is mostly security theater and marketing. I have an e2ee cha
by lrvick 3y ago
E2EE is only truly reliable if you control the endpoints fully, and verify keys. Short of that is is mostly security theater and marketing.
I have an e2ee chat where everyone in it is a security researcher that exclusively accesses it from a dedicated QubesOS VM, and everyone has cross verified each others keys.
I have other e2ee chats where almost everyone but me is using iPhones, Android phones, windows, macos and no one verify keys, and thus I just operate as though anything said in those chat will be made public at any moment.
- palata 3y ago> Short of that is is mostly security theater and marketing. There is a difference between "security theater and marketing" and "threat model". A random ISP in a random country does not necessarily have the power to take over control on your iPhone, so with e2ee they just can't read your messages. It's not completely useless, it just depends on the threat model.
- throw0101a 3y ago> E2EE is only truly reliable if you control the endpoints fully […] And with all the zero-days being regularly found, even in open source software, you cannot be sure of that 100% of the time. How long did Debian's OpenSSL patch/bug exist before it was noticed?