Hacker News new | ask | show | jobs
by rhn_mk1 1367 days ago
The application processing the message for the purpose of displaying it is clear.

But if the message is copied, read, analyzed and sent further on behalf of a third party before encryption, then that puts that third party in the middle between the sender and the recipient. A man in the middle directly undermines e2ee: "no one else reads your message".

It doesn't matter if the third party made the messaging app or not. What matters is whether information in your messages is accessible to anyone besides you and the recipient.
1 comments
ale42 1367 days ago
E2EE doesn't prevent the app itself from analyzing messages locally, and sending updated interest profiles to meta... which can be a vector of weights or whatever thing they might be using to know what ads to show. If the logic is in the app, the message doesn't leave the app and E2EE is preserved.

This said, analyzing messages for the purpose of ad display is creepy, whatever the way it is done.

link
rhn_mk1 1367 days ago
E2EE most certainly does exclude analyzing messages anywhere for a third party.

Notice that "ends" in "end-to-end" are users, not applications. When an application forwards things to an entity, then that entity becomes an "end" of the conversation. When it displays a message to the user, the way the user wants, then the user is the end. When it processes the message and delivers results to Facebook, the way Facebook wants it, then the application makes Facebook the "third end".

In such scenario, Facebook had intercepted the message, just chose to forward only some extracted information (which may or may not be enough to reconstruct the original). This does not match the definition of "end-to-end encryption".

link
viraptor 1367 days ago
> Notice that "ends" in "end-to-end" are users, not applications.

That's not right. First, it's technically an impossible, since users can't do encryption themselves - it's the application that does it. That's where the e2ee boundary is.

Second, we've got e2ee communication between non-user entities as well. There's are servers using for example zerotier which communicate e2ee through other nodes. Third, applications can definitely send the data to other parties automatically. WhatsApp executing backups as configured does not make it not e2ee.

link
rhn_mk1 1366 days ago
It's not a distinction between softwares, it's a distinction between agents. I.e. who the software works for.
link