Re:Web-based cryptography is always snake oil
by emersion on Sunday June 25, 2023 @05:07AM
(#36466259)
Updating is fine as long as it's from a auditable repository with full source code history, and built by a third-party like a distro (or the build is reproducible).
Re:Web-based cryptography is always snake oil
by skrebbel on Sunday June 25, 2023 @05:28AM
(#36466361)
Who really reads the source code though?
The idea is that enough people do that if something bad happens, it makes the news, by which I mean Twitter/Mastodon/HN/LWN and so on.
By which time we get this:
Re:Web-based cryptography is always snake oil
by goodpoint on Sunday June 25, 2023 @05:11AM
(#36466280)
A repository with history is not enough. It's easy to circumvent.
You need software packages reviewed and signed by trusted parties - aka a traditional Linux distro.
Re:Web-based cryptography is always snake oil
by kpdemetriou on Sunday June 25, 2023 @08:44AM
(#36467629)
The impact of E2EE in the event of database compromises is a little under-rated because the conversation often centers around the maximalist targeted survaillenace threat model. Yet, many more individuals will be affected as a result of plain old data breaches.
Re:Web-based cryptography is always snake oil
by NoZebra120vClip on Sunday June 25, 2023 @09:20AM
(#36467936)
> always run the latest updates, to protect against 0-days
How does running the latest updates protect against 0-days? Wouldn't the latest updates be bundling the latest 0-days? The latest updates mitigate known vulnerabilities, not 0-days.
It does not seem to me that there is any middle ground, barring writing your own client, from scratch, against an open protocol.
EDIT: seems to me that web-based e2e encryption, as described here, still protects you from irresponsible employees of the service reading your messages. And database leaks etc. Getting an update that spies on customers shipped is not a trivial thing in most organisations.