Hacker News Reader

Comment by FabCH | Hacker News Reader

What is the relevant definition of client and server if they are both peer devices under roughly equal level of control of a single entity?

View on HN

The client in your family members devices has encryption keys that you do not have in your client or on the server

Ok but again, that is introducing an arbitrary split that is not based on tech. What if I have two phones? Would you expect phone A to see images taken by phone B? If yes, obviously my phones need to share keys.

So what is different in saying „All family devices should see images taken by any device“? They are all clients, including the storage&processing device.

Insisting that E2EE have „ends“ on clients is not useful. It’s much better to define „end“ based on control.

E2EE, by definition, means that the server storing the data can't decrypt it. Your server can decrypt the data. Thus, it's not E2EE. Is this a problem? No. You've decided that the server is trusted (a "peer device"), so it's fine if the server can decrypt the data. That's a perfectly reasonable security posture, but it's still not E2EE.

I don’t think there is a formal definition of E2EE.

Here’s Wikipedia’s definition:

„End-to-end encryption (E2EE) is a method of implementing a secure communication system where only the sender and intended recipient can read the messages“

Note the complete lack of client/server distinction. It’s simply about intended recipients.

In many cases "transport encryption" would also fit that definition.

E2ee is quite well established imho. The server at Hetzner (a.k.a. "someone else's computer") is NOT to be trusted in e2ee schemes. Until today I'd be willing to say everyone agrees on this, but now I doubt that :)

Reply on news.ycombinator.com