undefined | Better HN

0 pointsBender8mo ago0 comments

It is technically impossible for a large platform to implement E2EE without having a way to target one person to bypass it. True E2EE will always have to be a program external to the chat platform that handles keys out of band like OTR.

Legally it will never truly happen. Any platform saying they have E2EE is outright lying. Lavabit was an example of what happens when a large platform makes lawful intercept impossible. People keep telling me that Proton and Signal are E2EE and I will always offer them a tropical island for sale on the dark side of the moon, heavily discounted. Moxie of all people should know better.

0 comments

palata8mo ago

> It is technically impossible for a large platform to implement E2EE without having a way to target one person to bypass it.

You'd have to explain what you mean here. If you mean that it's impossible to have encryption that is resistant to someone putting a gun on your face and asking for the password, then... well duh.

BenderOP8mo ago

If someone or something else is managing keys for you, even the javascript in your client, then it can be altered by the server just for you. It's really just that simple. If you are creating and managing key trusts outside of the application then they can not tamper with them or add their own keys.

palata8mo ago

I still don't understand what you are saying. You claim that Signal is not E2EE. Please explain.

Signal is an open source mobile app that I can audit and compile myself. How is it "obviously not E2EE"?

BenderOP8mo ago

Open source chat and open source AI just mean that the code you are looking at does not have an obvious back door. That has no bearing on run-time use and monkey-patching. As for Signal not being E2EE I already explained. I don't play the contrarian game so you will have to do your own research.

1 more reply

j / k navigate · click thread line to collapse

0 comments

palata8mo ago

> It is technically impossible for a large platform to implement E2EE without having a way to target one person to bypass it.

You'd have to explain what you mean here. If you mean that it's impossible to have encryption that is resistant to someone putting a gun on your face and asking for the password, then... well duh.

BenderOP8mo ago

palata8mo ago

I still don't understand what you are saying. You claim that Signal is not E2EE. Please explain.

Signal is an open source mobile app that I can audit and compile myself. How is it "obviously not E2EE"?

BenderOP8mo ago

1 more reply

j / k navigate · click thread line to collapse