Hacker News Reader

Comment by s_dev | Hacker News Reader

If someone other than sender or recipient can read messages -- it's not E2E.

I think you're grasping the wrong end of the stick.

If someone reports you, they (the people receiving the report) will be able to read the messages. This is the same if you use iMessage, Signal or any other system. (ie you take your phone to the police and show them the messages, they will see your messages, obviously.)

The key difference is that facebook has a button to report the message to them.

The recipients can do whatever they want.

Facebook is not a recipient and therefore should not be able to read e2e messages (that are not directed to them)

Edit: I just read that the reporting process includes sending unencrypted messages to WA as part of the report. So indeed the whole story is moot.

Technically the communication between both ends is encrypted. What each end does with the unencrypted content is out of the scope of E2E encryption.

By your logic signal is not e2e because I can copy a message from a friend and post it here.

e2e is only as secure as either of your e's

Actual problem is that you can't (must / should not) write your own client and control your keys).

If you have access to the message, you can do whatever you want with it. There is no way around that. End-to-end encryption is like a mathematically sealed envelop and only prevents seeing the message in transit. What sender or receiver choose to do is always up to them.

If the recipient then sends those messages to the cops, that doesn't mean it's not E2E.

Of course there's a bit of a sliding scale here. If the recipient automatically and unknowingly sends all past messages to the cops when they try to report a single abusive message, it's not E2E but it sure is a back door. It's not clear from the article just how much history is sent with each report.

Reply on news.ycombinator.com