3 ms·

Signal is always E2EE. Your confusion comes from whether the other party on that E2EE link is the one you expect, which is a different question but also one whe

by acdha 2y ago

Signal is always E2EE. Your confusion comes from whether the other party on that E2EE link is the one you expect, which is a different question but also one where the risk goes down with usage: the reason Hegseth’s chats blew up was that they added a reporter but never actually talked to them. There’s a lot wrong with that for discussing classified information but for normal people it’s fine because in most cases you’re going to notice when your friend doesn’t respond or shows no sign of awareness of your past conversations. “Literally useless” isn’t true in any scenario but it’s bad advice for anyone outside of such sensitive situations because it encourages use of apps which aren’t any better or are actually worse (WhatsApp, Telegram, Facebook, etc.).

aaomidi 2y ago
Okay I’ll say you’re being extremely pedantic. When someone says e2ee in this context they two “ends” clearly matter here. Trusting signal, without the out of band verification, does make its primary property useless yes. And for classified information that’s actually dangerous. The reason I use strong language here is that your comment clearly demonstrates the powers of marketing. People think just because they’re using signal now, everything is a-ok.
- acdha 2y ago
  It would be better to acknowledge that you used the wrong term the first time than trying to blame marketing. Signal always provides E2EE and that is always useful because it reduces the problem to worrying about the other end of the conversation, not all of the intermediaries. That doesn’t mean that you can blindly trust the other end, but that’s always true to varying extent - just because they’re using Signal doesn’t mean that their device hasn’t been compromised or that they are not forwarding messages or blabbing about something you expected to be secret. Signal doesn’t promise anything other than that your messages are secure between you and the other party. That’s the point to focus on rather than trying to redefine end-to-end encryption. It’s why you want to talk about security in the context of a threat model: Signal is designed for normal people, not high-level government officials working with classified information, where they have entire professions because the problem is fundamentally harder and mistakes can have significant consequences.
  - aaomidi 2y ago
    > It would be better to acknowledge that you used the wrong term the first time than trying to blame marketing. Cool, the web is also e2ee, because of TLS. See how silly it is?

by acdha 2y ago

aaomidi 2y ago

Okay I’ll say you’re being extremely pedantic. When someone says e2ee in this context they two “ends” clearly matter here. Trusting signal, without the out of band verification, does make its primary property useless yes. And for classified information that’s actually dangerous. The reason I use strong language here is that your comment clearly demonstrates the powers of marketing. People think just because they’re using signal now, everything is a-ok.

acdha 2y ago
It would be better to acknowledge that you used the wrong term the first time than trying to blame marketing. Signal always provides E2EE and that is always useful because it reduces the problem to worrying about the other end of the conversation, not all of the intermediaries. That doesn’t mean that you can blindly trust the other end, but that’s always true to varying extent - just because they’re using Signal doesn’t mean that their device hasn’t been compromised or that they are not forwarding messages or blabbing about something you expected to be secret. Signal doesn’t promise anything other than that your messages are secure between you and the other party. That’s the point to focus on rather than trying to redefine end-to-end encryption. It’s why you want to talk about security in the context of a threat model: Signal is designed for normal people, not high-level government officials working with classified information, where they have entire professions because the problem is fundamentally harder and mistakes can have significant consequences.
- aaomidi 2y ago
  > It would be better to acknowledge that you used the wrong term the first time than trying to blame marketing. Cool, the web is also e2ee, because of TLS. See how silly it is?