2 ms·

Isn't the whole point of using E2EE on Company A's messenger app that you distrust Company A? After all, they could easily serve up slightly different js when

Isn't the whole point of using E2EE on Company A's messenger app that you distrust Company A? After all, they could easily serve up slightly different js when you log into their website; for all practical purposes it would be undetectable. Being reasonably confident that you're running the same code as everyone else seems pretty important to me - and that's not how the web works.

wmf 3y ago
That's the ideal but browsers don't support that today. Trusting the client but not the server is weaker but still better than nothing.
- bawolff 3y ago
  > That's the ideal but browsers don't support that today. Which is why people say E2EE is unsuitable to the browser. Sure there exists other threats and other security issues in the browser, many of which can be addressed by various means, but that is a different thing than E2EE.