38 ms·
Isn't the main issue with e2ee on the web the fact that you're battling on three fronts? 1. You need to securely get the code and resources to the browser. A s
by mortallywounded 3y ago
Isn't the main issue with e2ee on the web the fact that you're battling on three fronts?
1. You need to securely get the code and resources to the browser. A state level attacker can make this very hard.
2. You need to securely run the code on the client which may or may not include code from n-third parties.
3. You need to securely handle data and logic from the client which may or may not involve n-third parties.
Phew. That's a heck of a challenge.
- tptacek 3y agoAn amateur attacker can make getting cryptographic code securely to a browser very hard. :)
- bawolff 3y ago> You need to securely get the code and resources to the browser. A state level attacker can make this very hard. Even worse, you need to securely get code to the browser without trusting yourself. The E2EE model assumes that you (the service provider/app maker) will turn evil at some future point. Code distribution is hard enough if you can trust yourself. Its basically impossible if the threat you are protecting against is your future self.
- ta2234234242 3y ago4. You need to not trust the cert authorities installed in a system.