> Fingerprinting can take care of the recompression problems.
That only opens another problem: adversarial attacks that look totally different, but has a similar fingerprint
>Right now what I see though is that Facebook/Google/Twitter aren't even trying to do the bare minimum end-to-end authentication that Whatsapp/Telegram/Signal already does (create a private key on the end devices, and sign the content to verify the authenticity of the publisher).
>Requiring HTTPS was a great first step for tech companies to protect people and from ISPs. But they do nothing to protect people from themselves being compromised (the Twitter incident was a great proof for this).
Mainly because to 99.9% of users, there's no difference between a message that's signed by the author, and a link to a tweet that's made by the author. Even if you're the 0.1% that do care about public key cryptography it doesn't matter because you're trusting the site to do the verification and key management. It's not like PGP where you can get the public keys and verify yourself.
There's also the problem that people simply don't care. Have you seen how many photoshopped tweets end up on social media? If people are willing believe a screenshot without a link (which is trivially easy to add and verify), what makes you think they won't believe a screenshot without a signature?