3 ms·
Yes, ultimately you have to trust your endpoint device when relying on e2ee. Having root access to that device does not significantly change that requirement.
by rainsford 3y ago
Yes, ultimately you have to trust your endpoint device when relying on e2ee. Having root access to that device does not significantly change that requirement. If you're worried about Apple and Google subverting your device to read your e2ee messages, them giving you root access does not actually solve the problem.
- TeMPOraL 3y agoEven if you trust Apple and Google not abusing their capabilities (which is somewhat reasonable in this context), both are still US companies - I imagine they could be ordered by the US government to pull your E2EE messages from device memory.
- cpach 3y agoFeel free to describe the steps you believe the company would take after receiving such a request.
- ben_w 3y agoI share TeMPOraL's opinion. I'd assume Apple and Google would seriously consider relocating if they were so ordered, even if they ultimately decided not to; but let's say for the sake of argument that they decide they have to supply the unencrypted content of messages of apps they didn't write running on operating systems they did write. If I was an engineer tasked with doing that, I would refuse, even if it meant leaving. But if I wasn't that kind of person, I'd have the OS take screenshots whenever a certain app was in the foreground.
- throw0101a 3y ago> I imagine they could be ordered by the US government to pull your E2EE messages from device memory. Under what law/statute?
- TeMPOraL 3y agoWhichever one is that lets them do it today. That's the reason US and the EU can't agree to a new privacy treaty.