> Reddit's new "private" chat system is powered by send bird without any additional end to end encryption.
> This means send bird provides a searchable plaintext database of all of these "private" chats.
> https://sendbird.com/features
> I like the (public) chat feature but to introduce "private" chats a feature that is clearly intended to increase interactivity and thus use of the feature without making this clear is just wrong IMO.
Hence the move to call things "direct" messages, rather than "private" as it used to be.
A practical example: https://signal.org/blog/private-contact-discovery/
I was thinking of having a third-party trusted services that compares the hash of the deployed application to the one they independently compiled themselves.
But the complexity is nontrivial and there is enough variations between the output of the same source code across different build environments that would make hashes useless.
Another possibility is having trusted compilers that would send link the source code to the build in a trusted repository.
When the sender and recipient are connected directly to the same system, there are no endpoints.
"Customers can choose to further encrypt the messages prior to sending and after receiving for end- to-end encryption as needed (but this will cause moderation tools and search features to malfunction)."
Reddit may prefer to not provide end-to-end encryption due to reasons, say, keyword marketing.
https://help.sendbird.com/hc/en-us/articles/235854108-Are-yo...
https://aurorabbit.github.io/emojicrypt.com/
It encrypts messages with a passphrase using scrypt, AES-GCM, and sha256 for an HMAC.
Each v1 protocol message includes a salt/iv, scrypt N&r, HMAC, and whether or not to lower-case the password. All messages encrypted with the proof-of-concept will be decrypt-able by all future clients, as there's room for 13 more protocol versions.
The code is in complete disarray, and I wouldn't want anyone to sift through it in it's current state[1], but the proof-of-concept is finished, and life came up, so it's been sitting since.
I have a list of features[2] I want to add in the issues tracker :)
[1] if you do want to sift through it don't miss https://github.com/aurorabbit/libemojicrypt. I separated the repos without following through on that reorganization.