undefined | Better HN

0 pointsAndrew_nenakhov5y ago0 comments

But the commenter above claimed that trust in entities is fleeting? And we have proven that Apple can read your messages if they really want to. [1]

Also, if you are concerned that state will seize your server physically - then you should probably put the server to a place where it can't.

[1]: https://news.ycombinator.com/item?id=24058454

0 comments

3 comments · 1 top-level

monadic25y ago· 2 in thread

Sure, trust in entities is fleeting, but they aren’t giving at better way to trust (as you are are not).

I’m not sure what the point of pretending to be ignorant about encryption is supposed to do.

Andrew_nenakhovOP5y ago

If you want real security, you minimize externalized trust. By running your own server you do not have to trust anyone but yourself. And if the server is your own, you don't even need e2ee because in the threat model against which e2ee is helpful the offender is server operator. Replace server operator with yourself, and you remove the need for e2ee.

Of course, if you want a cozy sense of being secure, instead of real security, you say, 'I use end-to-end encryption which I was told makes reading my messages impossible'. With iMessages you can't really verify if your messages are not being sniffed (unlike Signal, or XMPP, I must add), and we now have proven Apple DOES have a potential way to read your messages if they really want it. But you TRUST them not to read your messages. So why bother with E2EE at all, if you already trust them not to spy on you?

(Also, how come people who religiously insist on using an always-on E2EE for their chats are totally fine with Gmail which stores every mail totally unencrypted?)

monadic25y ago

There is no such thing as “real security”, only varying degrees of protection from a specific threat model. You’ve clearly gained a lot of confidence thinking about this specific threat model while neglecting a more general and useful way to engage in discussion about threat models.

Among other things, you don’t write all the software that goes on your computer, let alone build the hardware yourself, so you’re not “really” secure at all. And because you do claim “real security”, I can’t square your statements with any threat model I can imagine.

j / k navigate · click thread line to collapse