Lack of trust in end-to-end encryption (E2EE) due to potential compromises in the user's environment

Signals over time

4 observed signals across 1 sources, tracked for 4 days. Confidence: low.

What people are saying Observed

• “In a sense I am. We kind of both are, I'd say, for reasons we each think are important. For example: - you may wish to protect the trust in / reputation of E2EE, and so you might gonna have an axe to grind with in-browser implementations, and thus you may feel compelled to segment this subject accordingly - I kind of have an axe to grind with E2EE exactly because of how little it can actually guarantee to begin with, so rather than protecting the trust and reputation of E2EE, I feel drawn to correct the popular record, and spread the word about the very serious limitations of this thing, making me segment accordingly (although I do think that even beyond this, I am right to bikeshed this) I'm speculating on your part obviously, though not on mine. I think of E2EE as a bare minimum, not something to be particularly proud of and market, and the more I learn about how we secure our devices over the years and decades, the more distraught I feel about these technological measures. It's a lot more smoke than fire. At the same time, I could also apologize for the bikeshedding, but then I'd hope it's clear that it's not like I did it to annoy you or anyth”

  Hacker News · complaint

• “E2EE can technically exist on a web app, but it would be stupid to rely on it, so, yeah, I'd just be careful when using the term for web apps, since you get something way less secure than what the term evokes.”

  Hacker News · frustration

• “> I am not sure what you are trying to say. That "trusting the code that runs in your browser when you load the website of a messaging webapp to actually facilitate E2EE" is out of scope for the question "is E2EE in a browser possible". > I would argue that it is. This is what I very directly disagree with. In both your Manhattan example, your browser example, or in my very own shoulder surfing example, it's not that E2EE isn't in place, it's that it is rendered useless by the circumstances. That is a distinct matter. The same applies to your heavily audited, reproducibly built, hash and signature checked, native, installed application. Worth jack if your phone itself, or the virtual keyboard you're typing on, etc, is compromised. If this is how you segment things, E2EE cannot exist, hence why this is an incoherent segmentation; it selects for nothing that can actually exist, the label never truly applies. It's a category mistake.”

  Hacker News · frustration

• “I am not sure what you are trying to say. Let me try an example. Say you have a device that projects the screen on a skyscraper in Manhattan, visible by tens of thousands of people in real time. You can do all the cryptography you want, I would argue that you fundamentally cannot achieve "privacy" on that device, because "thousands of random people seeing it" means it is not private, by definition. Sure, you can run Signal on that device, and it does actually run sound E2EE maths. But it is not an "end-to-end encrypted deployment", it is a public deployment that happens to be running E2EE cryptography. What I say is that running E2EE in a browser has that kind of nuance (as far as the comparison goes, obviously). In that the browser is indeed running E2EE cryptography, but it is not an "end-to-end encrypted deployment", because the user has to trust the server. > This is not a coherent segmentation for whether E2EE is possible and engaged. I would argue that it is. Just like E2EE is not "possible and engaged" on the skyscraped in Manhattan, I argue that it cannot be in a browser. The browser is running sound cryptographic code, b”

  Hacker News · frustration