<story><title>Element is one of fourteen messaging apps blocked by Central Indian Government</title><url>https://element.io/blog/india-bans-flagship-client-for-the-matrix-network/</url></story><parent_chain><item><author>NayamAmarshe</author><text>&amp;gt; Signal is e2ee.&lt;p&gt;That still does not change anything though. The backend is unverifiable, that&amp;#x27;s a fact. Why talk about E2EE, I wasn&amp;#x27;t really talking about that.&lt;p&gt;Signal for a whole year was running a different server code and nobody even could tell that they added some cryptocoin stuff. On top of that, metadata, server connection and anything other than the message content is all at the mercy of the server owner.</text></item><item><author>jraph</author><text>Signal is e2ee. The point of e2ee is that you can &lt;i&gt;not&lt;/i&gt; trust the backend code (except for clear data it actually manipulates - which is still an issue indeed - Message contents are encrypted though)&lt;p&gt;This is the case for any e2ee solutions. For instance my company develops CryptPad [1], which is a full open source office suite with e2ee. The server admins can&amp;#x27;t access your content and you don&amp;#x27;t need to trust the backend, which just passes messages and store encrypted messages. This is the whole point. e2ee has drawbacks: it&amp;#x27;s very difficult, if not impossible, to provide indexed search for encrypted content on the server, the client needs to do it which might be impractical.&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;cryptpad.org&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;cryptpad.org&amp;#x2F;&lt;/a&gt;</text></item><item><author>NayamAmarshe</author><text>Nobody can verify backend code though, that&amp;#x27;s always an issue.</text></item><item><author>jraph</author><text>&amp;gt; This is basically an indirect validation that most non listed messaging apps supposedly offering e2e encryption such as Whatsapp or Signal have backdoors with access from any government asking for access.&lt;p&gt;Not really. At least, I&amp;#x27;m not convinced. Signal for instance does not have public channels like Matrix has, maybe that&amp;#x27;s the big difference. Signal&amp;#x27;s code can also be audited if in doubt (well, actually, Signal could always provide altered binaries on the App Store and Google Play Store, you&amp;#x27;d have to build it yourself to be sure - though they do have reproducible builds for Android [1]).&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;signal.org&amp;#x2F;blog&amp;#x2F;reproducible-android&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;signal.org&amp;#x2F;blog&amp;#x2F;reproducible-android&amp;#x2F;&lt;/a&gt;</text></item><item><author>prmoustache</author><text>&amp;gt;Some of the mobile applications that have been blocked include Crypviser, Enigma, Safeswiss, Wickrme, Mediafire, Briar, BChat, Nandbox, Conion, IMO, Element, Second line, Zangi, Threema, and others.&lt;p&gt;&amp;gt; While investigating one of these channels, it was discovered that the app did not have a representative in India, making it challenging to monitor activities on the platform.&lt;p&gt;This is basically an indirect validation that most non listed messaging apps supposedly offering e2e encryption such as  Whatsapp or Signal have backdoors with access from any government asking for access.</text></item></parent_chain><comment><author>e12e</author><text>&amp;gt; That still does not change anything though.&lt;p&gt;Of course it does. Just like PGP works fine over untrusted channels - like if I posted a gnupg ascii-armored message here.&lt;p&gt;e2ee makes &lt;i&gt;all&lt;/i&gt; the difference - if two trusted and mutually authenticated clients are communicating with proper e2ee - the best an attacker can do is traffic analysis and denial of service...?</text></comment>
<story><title>Element is one of fourteen messaging apps blocked by Central Indian Government</title><url>https://element.io/blog/india-bans-flagship-client-for-the-matrix-network/</url></story><parent_chain><item><author>NayamAmarshe</author><text>&amp;gt; Signal is e2ee.&lt;p&gt;That still does not change anything though. The backend is unverifiable, that&amp;#x27;s a fact. Why talk about E2EE, I wasn&amp;#x27;t really talking about that.&lt;p&gt;Signal for a whole year was running a different server code and nobody even could tell that they added some cryptocoin stuff. On top of that, metadata, server connection and anything other than the message content is all at the mercy of the server owner.</text></item><item><author>jraph</author><text>Signal is e2ee. The point of e2ee is that you can &lt;i&gt;not&lt;/i&gt; trust the backend code (except for clear data it actually manipulates - which is still an issue indeed - Message contents are encrypted though)&lt;p&gt;This is the case for any e2ee solutions. For instance my company develops CryptPad [1], which is a full open source office suite with e2ee. The server admins can&amp;#x27;t access your content and you don&amp;#x27;t need to trust the backend, which just passes messages and store encrypted messages. This is the whole point. e2ee has drawbacks: it&amp;#x27;s very difficult, if not impossible, to provide indexed search for encrypted content on the server, the client needs to do it which might be impractical.&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;cryptpad.org&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;cryptpad.org&amp;#x2F;&lt;/a&gt;</text></item><item><author>NayamAmarshe</author><text>Nobody can verify backend code though, that&amp;#x27;s always an issue.</text></item><item><author>jraph</author><text>&amp;gt; This is basically an indirect validation that most non listed messaging apps supposedly offering e2e encryption such as Whatsapp or Signal have backdoors with access from any government asking for access.&lt;p&gt;Not really. At least, I&amp;#x27;m not convinced. Signal for instance does not have public channels like Matrix has, maybe that&amp;#x27;s the big difference. Signal&amp;#x27;s code can also be audited if in doubt (well, actually, Signal could always provide altered binaries on the App Store and Google Play Store, you&amp;#x27;d have to build it yourself to be sure - though they do have reproducible builds for Android [1]).&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;signal.org&amp;#x2F;blog&amp;#x2F;reproducible-android&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;signal.org&amp;#x2F;blog&amp;#x2F;reproducible-android&amp;#x2F;&lt;/a&gt;</text></item><item><author>prmoustache</author><text>&amp;gt;Some of the mobile applications that have been blocked include Crypviser, Enigma, Safeswiss, Wickrme, Mediafire, Briar, BChat, Nandbox, Conion, IMO, Element, Second line, Zangi, Threema, and others.&lt;p&gt;&amp;gt; While investigating one of these channels, it was discovered that the app did not have a representative in India, making it challenging to monitor activities on the platform.&lt;p&gt;This is basically an indirect validation that most non listed messaging apps supposedly offering e2e encryption such as  Whatsapp or Signal have backdoors with access from any government asking for access.</text></item></parent_chain><comment><author>akvadrako</author><text>First, it doesn&amp;#x27;t matter a lot if the backend is verifiable with E2E, that&amp;#x27;s the point.&lt;p&gt;Second, some sensitive parts of Signal backend are verifiable, assuming Intel is not compromised, because they use Intel SGX.</text></comment>