5 ms·
If your threat model is such that it's perfectly fine for the server to know everything that's coming from and going to the client, there's no problem at all. T
by mort96 1y ago
If your threat model is such that it's perfectly fine for the server to know everything that's coming from and going to the client, there's no problem at all. That's probably your situation, it's okay that the server knows what notifications it's sending to your app.
If your threat model is such that you'd rather not have the server know what's sent to and from the client, it's not enough to just encrypt the data in flight, which is what HTTPS does. With encrypted chat, we typically want what we refer to as end-to-end encryption, where the server can't see the content of messages sent between users.
- tonyhart7 1y agothen what happen if E2EE receiver is server itself??? I want to prevent vector attack such MiTM if TLS is somehow hacked
- mort96 1y agoIn a typical server-backed web app architecture, TLS is the protection against MITM. You're gonna have a really really hard time making something which protects against MITM better than TLS. There are things you can do to make it more difficult to hack your TLS connection though, for example you could use key pinning to make sure that your app will only accept a server with the certificate you expect. This would protect against an IT admin installing root certs on their users' devices, or against certificate authorities issuing fake certificates for your domain.
- tonyhart7 1y agoYeah this app maybe don't need that but for things like IoT running websocket connection for long time maybe I need that
- hiimkeks 1y agoAh, the Zoom Gambit