Hacker News new | ask | show | jobs
by arlort 1452 days ago
You can't, not in a perfectly verifiable way

At some point app A needs to know how to decrypt messages received on app B and/or vice-versa

Nicely designed apps will do so on your device, shady apps will do so on servers, as a consumer you'll have to decide which companies behave and design their apps in a way that is satisfactory to you

But you have to do that to use any app in the first place. If you're using a messaging app it means you trust its developers and how much data they collect and how they handle it. Adding a "how do they handle interoperation" checkbox does not significantly change that calculus imo

(as to how E2E can work with interoperability, with an open API app A will just ping app B's servers in addition to its own and will have its own E2E key as well as B's key. Groups could be more complicated but group encryption is a pretty hard problem anyway and you might just give up and warn your users that cross-platform groups won't be E2EE)

1 comments

If an app is decrypting on a server instead of your device, it's not E2EE period. It's false advertising to call it E2EE. People can have bridges and such, but you know if you're controlling it or not, or it can just be local.
Hence the "shady" part