6 ms·

Why's that, given that files are encrypted?

• throwawayffffas 1y ago
  With whose key? I am not saying the service is not trust worthy, just that there is trust involved. Trust not only they are not malicious, but also they won't have some kind of vulnerability. Plus if it's encrypted how is the other party going to read the file? The key will have to take the same path.
  • deleted 1y ago
    [deleted]
  • actionfromafar 1y ago
    Hopefully it's a privpub negotiation. But yes, you have to trust the code.
  • Dylan16807 1y ago
    > Trust not only they are not malicious, but also they won't have some kind of vulnerability. Wouldn't that still be the case if relay servers didn't exist? A hacked version can send your file to the wrong person.
    • throwawayffffas 1y ago
      There is more attack surface with a server. The vulnerability doesn't even have to be in their software, but in any piece of software they use, ssh, nginx, etc.
      • Dylan16807 1y ago
        A compromised relay server can't access the data because it's encrypted. A meaningful vulnerability would have to be in either the software itself or in the coordination server. That attack surface is the same whether or not you have relays. You can reduce the attack surface to just the software if there's a way for users to verify keys manually. But again, same attack surface whether or not you have relays.
  • deleted 1y ago
    [deleted]