3 ms·

Okay I’ll say you’re being extremely pedantic. When someone says e2ee in this context they two “ends” clearly matter here. Trusting signal, without the out of

Okay I’ll say you’re being extremely pedantic. When someone says e2ee in this context they two “ends” clearly matter here. Trusting signal, without the out of band verification, does make its primary property useless yes. And for classified information that’s actually dangerous. The reason I use strong language here is that your comment clearly demonstrates the powers of marketing. People think just because they’re using signal now, everything is a-ok.

acdha 1y ago
It would be better to acknowledge that you used the wrong term the first time than trying to blame marketing. Signal always provides E2EE and that is always useful because it reduces the problem to worrying about the other end of the conversation, not all of the intermediaries. That doesn’t mean that you can blindly trust the other end, but that’s always true to varying extent - just because they’re using Signal doesn’t mean that their device hasn’t been compromised or that they are not forwarding messages or blabbing about something you expected to be secret. Signal doesn’t promise anything other than that your messages are secure between you and the other party. That’s the point to focus on rather than trying to redefine end-to-end encryption. It’s why you want to talk about security in the context of a threat model: Signal is designed for normal people, not high-level government officials working with classified information, where they have entire professions because the problem is fundamentally harder and mistakes can have significant consequences.
- aaomidi 1y ago
  > It would be better to acknowledge that you used the wrong term the first time than trying to blame marketing. Cool, the web is also e2ee, because of TLS. See how silly it is?

3 ms·

Okay I’ll say you’re being extremely pedantic. When someone says e2ee in this context they two “ends” clearly matter here. Trusting signal, without the out of

by aaomidi 1y ago

acdha 1y ago
It would be better to acknowledge that you used the wrong term the first time than trying to blame marketing. Signal always provides E2EE and that is always useful because it reduces the problem to worrying about the other end of the conversation, not all of the intermediaries. That doesn’t mean that you can blindly trust the other end, but that’s always true to varying extent - just because they’re using Signal doesn’t mean that their device hasn’t been compromised or that they are not forwarding messages or blabbing about something you expected to be secret. Signal doesn’t promise anything other than that your messages are secure between you and the other party. That’s the point to focus on rather than trying to redefine end-to-end encryption. It’s why you want to talk about security in the context of a threat model: Signal is designed for normal people, not high-level government officials working with classified information, where they have entire professions because the problem is fundamentally harder and mistakes can have significant consequences.
- aaomidi 1y ago
  > It would be better to acknowledge that you used the wrong term the first time than trying to blame marketing. Cool, the web is also e2ee, because of TLS. See how silly it is?