2 ms·

then what happen if E2EE receiver is server itself??? I want to prevent vector attack such MiTM if TLS is somehow hacked

• mort96 1y ago
  In a typical server-backed web app architecture, TLS is the protection against MITM. You're gonna have a really really hard time making something which protects against MITM better than TLS. There are things you can do to make it more difficult to hack your TLS connection though, for example you could use key pinning to make sure that your app will only accept a server with the certificate you expect. This would protect against an IT admin installing root certs on their users' devices, or against certificate authorities issuing fake certificates for your domain.
  • tonyhart7 1y ago
    Yeah this app maybe don't need that but for things like IoT running websocket connection for long time maybe I need that
• hiimkeks 1y ago
  Ah, the Zoom Gambit
  • tonyhart7 1y ago
    wdym, elaborate
    • hiimkeks 1y ago
      The first time zoom announced E2EE, they didn't actually have it and then said something like "well the server is the end, and then there is another end...". IIRC In the end they acquihired keybase so they fix the crypto for them.