71–78 of 78 posts
Kind of meaningless if you can't trust the software running on your device though, since it could be scanning locally or relaying to remote services.
So run free software?
https://mako.cc/copyrighteous/google-has-most-of-my-email-be...
What I find intriguing is that E2EE was significantly more common long ago than it is today. Multi-protocol chat clients would utilize the OTR libraries meaning 'off the record' and even auto-negotiate with folks over AIM, MSN, ICQ, IRC and others to assist in showing fingerprints and sharing public keys which could be done over the platform or out of band if one so wished. I would have expected that by today that no…
Please note that OTRv3 uses significantly outdated encryption. There is OTRv4 but it isn't finished yet.
https://bugs.otr.im/otrv4/otrv4 https://github.com/otrv4/otrv4/
How do you know if the Signal client running on your phone right now doesn't include a backdoor? Sure it's open source. But how do you know how it was compiled? What if someone changed the open source before shipping it to the app store?
This is called "Reproducible Builds". https://signal.org/blog/reproducible-android/
Otherwise somewhere in the chain you are relying on binaries of unknown provenance.
Earlier quoted context omitted.
So run free software?
It isn't enough to run free software, all your contacts need to do that as well. It is the old gmail problem highlighted by Mako Hill: https://mako.cc/copyrighteous/google-has-most-of-my-email-be...
Briar Project appear to be a good E2EE messaging app. https://briarproject.org/how-it-works/
Which is of course entirely incompatible with everything else. We have tons of good E2EE messaging apps, all doing their own thing...
Remember when Zoom claimed that meetings were E2EE yet you could join the meeting by phone and no one batted an eye for at least one or two years? Noticed how no regular person cares when the "security code" of a chat partner changes in WhatsApp or Signal? Not to mention no regular person uses self-compiled apps for that, even if it were possible. E2EE is close to becoming a cargo cult, because done properly key mana…
IMhO, one company tacled that very problem head on and did a fantastic job and it's my by far prefered chat (+ more) app today. Ironically, that company, https://keybase.io , got acquired by Zoom. Keybase still works today (thankfully), but there are AFAIK no guarantees for how long. Keybase Chat is fully encrypted, persistent, and cross platform, and has the best solution to the identity problem.
As I understand it, if we had true end-to-end encryption, I would have to make sure I kept a set of keys, copied them between every computer and phone I used for chatting, and if I lost those keys I'd lose all my messages? Honestly, for most people I don't think that's functionality they would want, at least without us getting much better at interfaces and usability. Standard ways of storing keys, for example in a pa…
> As I understand it, if we had true end-to-end encryption, I would have to make sure I kept a set of keys, copied them between every computer and phone I used for chatting, and if I lost those keys I'd lose all my messages? Unless you made an unencrypted backup, then yes, that's true and that is the reason why Telegram decided against E2EE by default. According to them their users prefer easy cloud access to their m…
And likewise with e-mail, PGP et al. break some features that rely on your mail server having access to the full message contents, like content-based message filtering (spam or otherwise) and server-side search.