4 ms·

Most of the E2E claims are based on technicalities: like when you upload a file via HTTPS it is encrypted and then when you download it later via HTTPS, the tra

Most of the E2E claims are based on technicalities: like when you upload a file via HTTPS it is encrypted and then when you download it later via HTTPS, the transfer itself is encrypted. Therefore, E2E encryption. In a previous life, the killer app for E2E was "encrypted email" where a lot of companies would claim they do email encryption by having outside recipients visit a website for which the recipient would get a password by SMS in order to read the email sent. And because the website was hosted by the sender on HTTPS... voila, encrypted email. And the sales people from this companies all kept a straight face when explaining how secure the encryption was.

deleted 3y ago
[deleted]
MattPalmer1086 3y ago
That is not E2E encryption, that is Point to Point (P2P) encryption. To be E2E, the file should only be decryptable by the sender and receiver. The point in the middle should not be able to see it's plaintext or decrypt its ciphertext.
- Culonavirus 3y ago
  It's also what the article omits... Yes, "the authority" that made the E2E software can screw you over, sure, but that's where it ends. There are good reasons for E2E encryption beyond doing shady shit or messing with goverments. E2E solves an entire class of server-side security and personnel issues. Some moderator type of person browsing your nudes? Not possible. Hackers stealing data from the server? You don't care, they can't decrypt it.
  - MattPalmer1086 3y ago
    I completely agree. It's completely valid to say that E2E cannot protect you from the provider of the cryptographic software. It also fails if the end points themselves are compromised. There is still tremendous value in being protected from absolutely everyone else.
- ExoticPearTree 3y ago
  This is how they sold it: E2E. Could not reason with those people. What I am saying is that people tend to slap the E2E label on pretty much anything without understanding what it really means.

deleted 3y ago

[deleted]

MattPalmer1086 3y ago

That is not E2E encryption, that is Point to Point (P2P) encryption. To be E2E, the file should only be decryptable by the sender and receiver. The point in the middle should not be able to see it's plaintext or decrypt its ciphertext.

Culonavirus 3y ago
It's also what the article omits... Yes, "the authority" that made the E2E software can screw you over, sure, but that's where it ends. There are good reasons for E2E encryption beyond doing shady shit or messing with goverments. E2E solves an entire class of server-side security and personnel issues. Some moderator type of person browsing your nudes? Not possible. Hackers stealing data from the server? You don't care, they can't decrypt it.
- MattPalmer1086 3y ago
  I completely agree. It's completely valid to say that E2E cannot protect you from the provider of the cryptographic software. It also fails if the end points themselves are compromised. There is still tremendous value in being protected from absolutely everyone else.
ExoticPearTree 3y ago
This is how they sold it: E2E. Could not reason with those people. What I am saying is that people tend to slap the E2E label on pretty much anything without understanding what it really means.