• sbv@sh.itjust.works
    link
    fedilink
    English
    arrow-up
    38
    ·
    1 year ago

    It’s bizarre that Sunbird touted their solution as end-to-end encrypted, when it can’t be - iMessage drops to plaintext on the Mac farm.

      • entropicdrift@lemmy.sdf.org
        link
        fedilink
        English
        arrow-up
        27
        ·
        1 year ago

        While it’s a good solution, it is entirely untrue. A message is either End to End Encrypted or it is not. If the message is decrypted at any point between the sender and the intended recipient, it is definitively not End to End Encrypted.

      • habanhero@lemmy.ca
        link
        fedilink
        English
        arrow-up
        18
        ·
        1 year ago

        E2EE means it’s End-to-End Encrypted. If it’s decrypted at any point during transit then it’s by definition not E2EE and Beeper shouldn’t be making that claim.

      • SuddenlyBlowGreen@lemmy.world
        link
        fedilink
        English
        arrow-up
        9
        arrow-down
        1
        ·
        edit-2
        1 year ago

        It’s E2EE from the sender to your Beeper server, where it’s decrypted, then re-encypted as a Matrix message.

        Then it’s not E2E encrypted.

        One end is your device, the other end is the other device. It’s only E2E encrypted if it is not decrypted until it reaches the other device.

          • Spedwell@lemmy.world
            link
            fedilink
            English
            arrow-up
            7
            ·
            1 year ago

            Sticking two E2EE tunnels together with a plaintext middleman doesn’t result in a single E2EE tunnel.

            The reason the distinction is important is because the security profile is vastly different—a compromised server leads to a compromised message—which isn’t true for actual E2EE services like a pure Matrix link.

            Side note: the first thing you should ask of a “end-to-end encrypted” product to you is “which ‘ends’ do you mean?” I’ve seen TLS advertised as E2EE before.

            • Spedwell@lemmy.world
              link
              fedilink
              English
              arrow-up
              1
              ·
              edit-2
              1 year ago

              Adding: TLS is actually a pretty apt analogy here.

              You could make a chat server that just accepts plain text messages over a TLS link, and that’s basically the same security topology as with this Beeper bridge.

              But no one would call that a E2EE chat.

  • flop_leash_973@lemmy.world
    link
    fedilink
    English
    arrow-up
    16
    ·
    edit-2
    1 year ago

    Shady service turns out to be insecure and shady. I’m shocked. The real take away from this is if Nothing thought this was a good idea, what other horrible things have they done to their ROM we haven’t found out about yet.