4 ms·

I think the term they meant is "end-to-end encrypted" (e.g. the service has zero knowledge of your notes' content, only your own devices). Then again, even pop

by remram 3y ago

I think the term they meant is "end-to-end encrypted" (e.g. the service has zero knowledge of your notes' content, only your own devices). Then again, even popular services like CloudFlare use that term wrong, e.g. their setting where traffic is encrypted client-to-cloudflare and then separately cloudflare-to-server is called "end-to-end" in their dashboard. Once technical terms become marketing points, you can expect them to be used for a whole new variety of meanings.

deafpolygon 3y ago
Not to be nit-picky, but E2EE is not zero-knowledge. It's entirely possible for the data to be E2EE while the provider has all knowledge, partial knowledge or a little bit of knowledge of what you are transferring. I have seen services market E2EE while not being truly zero knowledge, so it's important to watch out for that sneaky marketing lingo.
- remram 3y ago
  If the provider has all knowledge, I don't think it deserves to be called E2EE at all. E2EE implies (to me) that decryption doesn't happen until your message has reached the other end. Any decryption on the server/relay/middleman, even if re-encrypting, is not what I call E2EE.
  - deafpolygon 3y ago
    I agree with you in principle, but being "E2EE" is just simply that - it's end-to-end encrypted. It says nothing as to who holds the encryption keys, and often times the host holds the key. Zero knowledge implies that the host has no knowledge (thus no keys) of your data.
    - remram 3y ago
      I'm not even talking about who has the keys, or whether the server can decrypt. I'm saying that if the server is decrypting and then re-encrypting, it is not "end-to-end".
diarrhea 3y ago
> Then again, even popular services like CloudFlare use that term wrong, e.g. their setting where traffic is encrypted client-to-cloudflare and then separately cloudflare-to-server is called "end-to-end" in their dashboard. “Woopsie, we marketed that wrong hehe”. It’s “wrong” on purpose.
cyanydeez 3y ago
Man-in-the-Middle encryption just don't sell as well...

by remram 3y ago

deafpolygon 3y ago

Not to be nit-picky, but E2EE is not zero-knowledge. It's entirely possible for the data to be E2EE while the provider has all knowledge, partial knowledge or a little bit of knowledge of what you are transferring. I have seen services market E2EE while not being truly zero knowledge, so it's important to watch out for that sneaky marketing lingo.

remram 3y ago
If the provider has all knowledge, I don't think it deserves to be called E2EE at all. E2EE implies (to me) that decryption doesn't happen until your message has reached the other end. Any decryption on the server/relay/middleman, even if re-encrypting, is not what I call E2EE.
- deafpolygon 3y ago
  I agree with you in principle, but being "E2EE" is just simply that - it's end-to-end encrypted. It says nothing as to who holds the encryption keys, and often times the host holds the key. Zero knowledge implies that the host has no knowledge (thus no keys) of your data.
  - remram 3y ago
    I'm not even talking about who has the keys, or whether the server can decrypt. I'm saying that if the server is decrypting and then re-encrypting, it is not "end-to-end".

diarrhea 3y ago

> Then again, even popular services like CloudFlare use that term wrong, e.g. their setting where traffic is encrypted client-to-cloudflare and then separately cloudflare-to-server is called "end-to-end" in their dashboard. “Woopsie, we marketed that wrong hehe”. It’s “wrong” on purpose.

cyanydeez 3y ago

Man-in-the-Middle encryption just don't sell as well...