3 ms·
Well, one example, depending on your threat model—their privacy policy states that they retain info and comply with subpoenas. There's also potential for malic
by hammyhavoc 2y ago
Well, one example, depending on your threat model—their privacy policy states that they retain info and comply with subpoenas.
There's also potential for malicious updates to compromise a network (as there is with most software unless you're auditing the source for each update).
E2EE is only as meaningful as where the keys reside, and how easily those keys are abused.
- aborsy 2y agoThat’s interesting! The metadata is generally public information, I don’t care about that. The malicious updates and key abuse are more concerning. It’s true for all software, and probably better done with OS, like on iOS. The VPN could steal the keys, but that’s a lawsuit!
- hammyhavoc 2y agoAre the keys not already kept on their own infra?
- aborsy 2y agoNo, private keys don’t leave user’s devices. This is the case in all such products. But with a malicious update, they could ship them to their infra, targeting some users. The product then becomes malware!