Hacker News Reader

Comment by jefftk | Hacker News Reader

I've always understood E2E to mean that it's encrypted from one end to the other, without any intermediate decryption stops. This is how https://en.wikipedia.org/wiki/End-to-end_encryption defines it, and has since it was a stub in 2007 (https://en.wikipedia.org/w/index.php?title=End-to-end_encryp...).

Do you have any links for E2E being used in this "older" way?

View on HN

A simple example could be something like using TLS or DTLS between all nodes in the network. But that doesn't mean data on a Zoom server sitting in the middle of a call is encrypted.

The point is that the term "E2E encryption" was never used for "there is TLS involved". Because that's not what end-to-end means.

E2E encryption was always clearly defined as "only the two communicating parties can access the information". Using the term "E2E encryption" in other ways is deliberately confusing. Edit: and pretending that E2E encryption meant something else in some unspecified past is revising history.

With true E2E encryption, could you support features like recording a video and making it available for download? If yes, does that reflect how their video recording features work now?

That’s not the point. If it’s not truly E2E, they shouldn’t market it as such.

“Military grade encryption” might’ve sold better too.

Don't forget another marketing favorite: "Bank-level encryption"

"Bank-level cryptography" with some of them still storing passwords in cleartext, and others made a very painful transition to unsalted md5 within the last 5 years because they "couldn't budget it in" any earlier.

No, thanks.

Why hire a software engineer when you can just run some ads about the dangers of identity theft instead?

You can always record at either end.

Sure you could. Either a participants client records the stream and uploads, or a ‘recording client’ is added to the conversation by the service.

However, I think the real value of mitm is more to do with redistribution of streams and muxing to reducing total bandwidth over that required by a full e2e encrypted p2p mesh. I.e one upload vs one per peer (although this could also be done with e2e encryption with multiple recipients and simply routing through the service) and potentially a single download too (depending on how the muxing is done), rather than one per peer (but this couldn’t be done with e2e encryption).

Yes, of course you can. But the recording has to be done on one of the clients.

Then the other client can download the video via the same e2e tunnel.

Reply on news.ycombinator.com