Hacker News new | past | comments | ask | show | jobs | submit login

>You have to choose between something you can use from whatever device you want, that you can simply log in into a web interface on whatever computer, or end2end encryption.

>Telegram made a choice of usability

Bullshit. Plenty of services have e2ee and cross-device usage. All you need for multi-platform e2ee is to sync an encryption key across devices. Either through a "trusted" party (like iMessage) or by literally syncing the key locally (Signal). You can even have one device act as the message store so you don't even keep store the encrypted messages in the cloud.

Telegram did not choose usability, they chose the opposite.




iMessage doesn't share private keys between devices. Each device has its own secret key, and when you send a message to a person with multiple devices, you encrypt multiple copies, one for each (source: https://support.apple.com/guide/security/how-imessage-sends-...)

An issue here is that the software doesn't show the user the list of keys used to encrypt a given message. If an attacker can inject their own keys into the identity service records for a given user, they would then receive a copy of all messages sent to that user.


It's true iMessage is not safe from such attacks, but you don't have to look further than Signal to see it's possible to create multi-device E2EE with seamless sync.

iMessage and its bad design can only serve the function of red herring here, let's leave it out from the discussion.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: