4 ms·

If you can't look at the code doing the encrypting, it's simply encoded.

deleted 1y ago
[deleted]
barbazoo 1y ago
> If you can't look at the code doing the encrypting, it's simply encoded. Not sure it being open source is required to be considered "encryption". Besides, even if you can look at the code you don't know if that's what's running on the server.
- SV_BubbleTime 1y ago
  I gave a charitable reading to that comment as “in terms of trust”.
- robmccoll 1y ago
  If I can look at the code, decide I trust the implementations of the primitives being used, how they're being used, how identity is established, and how initial key exchange works, I don't need to know what's running on the server. That's sort of the point of end to end encryption.
  - barbazoo 1y ago
    You mean using the algorithm to verify that the observable input leads to the observable output? That would make sense and would allow you to form an opinion about the "primitives" like you said.
  - deleted 1y ago
    [deleted]
  - csallen 1y ago
    I think they meant client
- lenerdenator 1y ago
  Of course it's a requirement to be considered encryption. Let's take this "encrypted" copy of the text in your reply: " Klq prob fq ybfkd lmbk plrozb fp obnrfoba ql yb zlkpfaboba "bkzovmqflk". Ybpfabp, bsbk fc vlr zxk illh xq qeb zlab vlr alk'q hklt fc qexq'p texq'p orkkfkd lk qeb pbosbo." I'm telling you that I applied state-of-the-art, uncrackable encryption to that. Why should you believe me? What evidence do you have that I didn't just take your text, throw it in some Caesar Cipher generator, and copy-paste it into this text box? Well, none. It just happens to look like I did that, and if that were data you wanted to keep secret but that a hacker had obtained without permission, you can bet that they would say "looks like a Caesar Cipher, I'll try a combination of decryption parameters until it makes sense". And in this case, they'd be absolutely correct.
lxgr 1y ago
If you don't trust whoever is handling your server-side secret computation, being able to view the code supposedly running there doesn't help either, as you won't have proof that that's what they're actually running. That's why we have proper end-to-end encryption in the first place: So that you don't have to trust the server.
- lenerdenator 1y ago
  How do you know that the server is being handed encrypted content?
  - lxgr 1y ago
    Hopefully via running your own client and seeing that the math still works out. If the service doesn't let you do that, that's obviously a problem.
    - lenerdenator 1y ago
      Does Xitter let you do that with the new feature?

deleted 1y ago

[deleted]

> If you can't look at the code doing the encrypting, it's simply encoded. Not sure it being open source is required to be considered "encryption". Besides, even if you can look at the code you don't know if that's what's running on the server.

SV_BubbleTime 1y ago
I gave a charitable reading to that comment as “in terms of trust”.
robmccoll 1y ago
If I can look at the code, decide I trust the implementations of the primitives being used, how they're being used, how identity is established, and how initial key exchange works, I don't need to know what's running on the server. That's sort of the point of end to end encryption.
- barbazoo 1y ago
  You mean using the algorithm to verify that the observable input leads to the observable output? That would make sense and would allow you to form an opinion about the "primitives" like you said.
- deleted 1y ago
  [deleted]
- csallen 1y ago
  I think they meant client
lenerdenator 1y ago
Of course it's a requirement to be considered encryption. Let's take this "encrypted" copy of the text in your reply: " Klq prob fq ybfkd lmbk plrozb fp obnrfoba ql yb zlkpfaboba "bkzovmqflk". Ybpfabp, bsbk fc vlr zxk illh xq qeb zlab vlr alk'q hklt fc qexq'p texq'p orkkfkd lk qeb pbosbo." I'm telling you that I applied state-of-the-art, uncrackable encryption to that. Why should you believe me? What evidence do you have that I didn't just take your text, throw it in some Caesar Cipher generator, and copy-paste it into this text box? Well, none. It just happens to look like I did that, and if that were data you wanted to keep secret but that a hacker had obtained without permission, you can bet that they would say "looks like a Caesar Cipher, I'll try a combination of decryption parameters until it makes sense". And in this case, they'd be absolutely correct.

lxgr 1y ago

If you don't trust whoever is handling your server-side secret computation, being able to view the code supposedly running there doesn't help either, as you won't have proof that that's what they're actually running. That's why we have proper end-to-end encryption in the first place: So that you don't have to trust the server.

lenerdenator 1y ago
How do you know that the server is being handed encrypted content?
- lxgr 1y ago
  Hopefully via running your own client and seeing that the math still works out. If the service doesn't let you do that, that's obviously a problem.
  - lenerdenator 1y ago
    Does Xitter let you do that with the new feature?