Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

>E2EE deals exclusively with the transit and reading of data between trusted ends, that's the point.

That's transit encryption. The point of E2EE is to prevent anyone, including the service provider from decrypting the communication. Apple making a backup copy of the comms that they can read breaks the E2EE.



>The point of E2EE is to prevent anyone, including the service provider from decrypting the communication.

The point is to prevent anyone between the ends from reading it, not anyone at all obviously. The ends are trusted by definition. Once the data reaches them, it's decrypted. They can then do whatever they want with that. The job of the E2EE is whatever happens in the middle (both in transit and at rest).

>Apple making a backup copy of the comms

What the heck are you talking about? Apple does not make a backup copy of the comms. Users may choose to use an Apple provided service that right now is not E2EE to make a backup themselves, if they wish. Or they can choose to backup in other ways (remember, Macs can access iMessage too). Those other backups that have nothing to do with Apple also may, or may not, be E2EE.


I see where you're coming from, and it's a bit of an old school view of E2EE. Wikipedia even has a section for the meaning of the term with a lot of citations requested, suggesting not everyone views the meaning of E2EE the same. https://en.wikipedia.org/wiki/End-to-end_encryption#Etymolog...

I wonder how far you would take the separation of functions. If Signal started offering a service to scan your messages and attachments for spam/malware, sending them plaintext from the app to their server to do so, does that break their E2EE? If they recommended the feature, implied that not enabling it was reckless, and didn't explicitly explain the result being Signal servers reading your messages?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: