Hacker News new | ask | show | jobs
by rcxdude 647 days ago
It's not meaningless (such applications are quite heavily inspected for signs of malfeasance by many parties that would stand to benefit from widely publicizing any backdoor), but it does substantially reduce the value, especially if your threat model includes being specifically targeted for a bypass.
2 comments

The whole point of all this fancy encryption is to make it mathematically impossible for the vendor to read your messages. It doesn't matter if it's mathematically impossible for them to read messages on the server if it's operationally trivial for them to extract them from the client.

It's end-to-end encrypted, but both ends are wide open for Discord to do what they like. If not them, someone doing a supply chain attack on their frivolously & opaquely updating proprietary clients.

WhatsApp has E2EE, but how do you think they found CSAM on people's devices? Because they control the endpoints.

You really think someone is out there reverse engineering and debugging every inch of the behemoth that is Discord, any part of which could leak the keys, or compromise them in some non-obvious way? In every release? Yeah, right.

Also, you should rethink "many parties ... would stand to benefit from widely publicizing any backdoor." A new bugdoor is found in WhatsApp every six months and nobody cares.