It wouldn't surprise me as recently the app tried to get me to trust an untrusted cert.
Technically, the exact packets of the data you send is E2E encrypted... but the copies they make for themselves aren't.
It's shocking to me how often this is glossed over when discussing E2EE services: you still must trust the platform.
The implementation of E2EE must be robust and there must be somebody who is actually checking the source code (plus verifiable builds)
Nothing makes software automatically super-crazy-secure. Absolute security doesn't exist.
And if so then what's the term for encryption that a middle man cannot decrypt?
I don't know if there's a term, but short of exchanging public keys in person there will always be a theoretical attack vector because there's always some[one|thing] in between you and your recipient.
No, it only implies avoiding a central server (and not even for every aspect of the service), you still run through routers, ISPs, NSA etc.
If you are certain that there's no middleman, you don't need encryption.
N.B. Maybe someone defines it in another way today, but when the term became popular, with Napster, it really meant simply not having a central server for certain functions, or even more banally not downloading your mp3s from a web site or ftp server; it did have some significance also because the legal aspect of it was more uncertain; when people started getting 100k dollars fines, peer-to-peer stopped meaning much, sometimes it's better to send packets directly to each other, other times through a server, but you almost always encrypt and almost always ought to encrypt end-to-end
I never implied a need for encryption associated with peer-to-peer. The parent comment asked about avoiding a middleman.
I have no idea what "end-to-end encryption" means, nor do I seek to know. I do not wish to be part of that debate. The record of how that term is being applied speaks for itself.
I do know of the term "end-to-end" as in https://en.wikipedia.org/wiki/End_to_end_principle One can find this concept in many of the early RFCs.
To me, "peer-to-peer" (with no central server) is in the spirit of end-to-end. This is why for example, people will sometimes say, "The internet was originally peer-to-peer."
Which I think it's pretty much how you defined it too in your (last) comment, so I'm not sure what we're debating.
The important thing was that no one reading these comments get the impression that the multitude of systems that describe themselves as "peer-to-peer" are for sure using "encryption that a middle man cannot decrypt".
---
> The parent comment asked about avoiding a middleman
Middle man in cryptography is anyone intercepting a message
---
> I have no idea what "end-to-end encryption" means, nor do I seek to know
Well, I don't mean to be rude, but then there's not much you can say in a discussion about encryption...
---
Look, the important thing was to underscore that the https://news.ycombinator.com/item?id=23554823 comment was (apparently) wrong, I don't have any interest in winning a battle, I appreciate your enthusiasm, you probably currently don't know everything about cryptography or networking and there's nothing wrong with that, no one is born expert and no one knows everything there is to know. I have to go to sleep, bye
All I said and cared to stress, to avoid that someone reading this make mistaken assumptions about p2p software (although probably few of this site's users would run the risk), is that ^^^they don't, as you claimed in https://news.ycombinator.com/item?id=23554823 , automatically imply "encryption that a middle man cannot decrypt"^^^.
You admitted you don't even know what end-to-end encryption is, and apparently don't know much about encryption, what are you debating?
---
> The term the parent comment used was "middle man" not man-in-the-middle
It's the same thing (unless the post author meant "a man of middle age")
---
> As for "E2EE", I have never seen djb even use that term
You mean Daniel J. Bernstein with djb? Do you mean that you are actually knowledgeable about encryption? I don't mean to be insulting but it didn't seem so (and there wouldn't be anything bad in that), it's hard to believe that someone with basic familiarity with encryption wouldn't know what end-to-end encryption is.
If with "that term" you meant the E2EE acronym, I indeed wouldn't be surprised if Daniel J. Bernstein never used it, it's the first time I see it myself (but it obviously doesn't mean anything more than "end-to-end encryption").
---
I don't know why you took it so personally, maybe I sounded aggressive in saying NO in uppercase, if so I'm sorry, it was just to make it more visible
https://web.archive.org/web/20051029045942/http://www.unc.ed...
Example comment: "Peer-to-peer is a viable design for videoconferencing for small groups. If one is concerned about a "middle man" then it is worth investigating a peer-to-peer design."