>and another approach is to do an own encrypted archive to store data and sync between your devices. public key of the other device and then have your device send packets to that >one is to pass over decryption keys to a new device (potentially breaking E2EE security model If you have two devices that can receive the message, that's still only accessible to you. End-to-end encryption does not refer to two devices, it refers to two parties. >Now, by downloading and decrypting it on another device, you are adding a THIRD end where is is accessible You have to face it: true E2EE is not achievable without significant sacrifices of user experience. If you don't follow this rule, you make a travesty out of E2EE, basically stating that all you really need is a nice and cozy feeling of being secure, not true security. It's not E2EE at all, actually, cause you'll be breaking the security model for some convenience, because the idea of e2ee is to communicate only with devices, each and every one of which were authorized by you. You basically encrypt data and store it on a server, decrypting it with your password or certificate or something that you share between devices. To achieve that, you have basically two options: one is to pass over decryption keys to a new device (potentially breaking E2EE security model for another guy who does not expect you to use 2 devices without his explicit authorization), and another approach is to do an own encrypted archive to store data and sync between your devices. Now, by downloading and decrypting it on another device, you are adding a THIRD end where is is accessible. End to End Encryption means that the data is encrypted between TWO ends, your device and the device of your chat partner. Just stop and think about it for a second.
0 kommentar(er)
