this post was submitted on 10 Jun 2025
498 points (99.4% liked)

Technology

71396 readers
3655 users here now

This is a most excellent place for technology news and articles.

Our Rules

  1. Follow the lemmy.world rules.
  2. Only tech related news or articles.
  3. Be excellent to each other!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
  9. Check for duplicates before posting, duplicates may be removed
  10. Accounts 7 days and younger will have their posts automatically removed.

Approved Bots

founded 2 years ago
MODERATORS
L3s@lemmy.world
enu@lemmy.world
technopagan@lemmy.world
L4s@lemmy.world
L3s@hackingne.ws
L4s@hackingne.ws
498
An analysis of X(Twitter)'s new XChat features shows that X can probably decrypt users' messages, as it holds users' private keys on its servers (blog.cryptographyengineering.com)
submitted 4 days ago by Pro@programming.dev to c/technology@lemmy.world
43 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] EncryptKeeper@lemmy.world 0 points 2 days ago

I'm saying that a company can just arbitrarily decide (like you did) that the server is the "end" recipient (which I disagree with).

They cannot. Thats not how E2EE works. If they can arbitrarily decide that, then it isn’t E2EE.

That can be done for chat messages too.

It cannot, if you’re using E2EE.

You send the message "E2EE" to the server, to be stored there (like a file, unencrypted), so that the recipient(s) can - sometime in the future - fetch the message, which would be encrypted again, only during transport.

That’s not how E2EE works. What you are describing is encryption that is not end-to-end. E2EE was designed the solve the issue you’re describing.

This fully fits your definition for the cloud storage example.

It does not. Cloud storage is a product you’d use to store your data for your own use at your own discretion.

I would argue that the cloud provider is not the recipient of files uploaded there

It is if you uploaded files to it, like on purpose.

You’re confusing E2EE and non E2EE encryption.