End-To-End Encryption (E2Ee)
- •
What it is
- •
Encryption applied to a message before it ever leaves your device, so that only the sender and intended recipient can read it — not the server relaying it in between.
- •
- •
Why it matters
- •
Without it, your "private" messages are stored and passed through a server that the service provider (or anyone who compromises that server) can read at will, without you ever knowing. E2EE removes the provider from the set of parties who can read your content, assuming they don't hold either party's private keys.
- •
- •
Limitations
- •
E2EE protects content, not metadata. A provider can still see who you're talking to, how often, and when — see Metadata. Also, not all E2EE is equally trustworthy: native apps (like Signal) run identical, inspectable code on every install, so a backdoor could eventually be caught by reverse engineering. Web-based E2EE (like a webmail or web vault client) has its cryptography code served dynamically by the server on each visit — a malicious server could quietly serve different, compromised code to a specific target, and because different users can be served different code, it would be extremely hard to prove after the fact. Native applications are the more trustworthy implementation for this reason.
- •
- •
Related
- •
Cards
- •
Why is web-based E2EE considered less trustworthy than a native E2EE app?
- •
The server can dynamically serve different (potentially malicious) JavaScript to specific targets on each visit, making a targeted backdoor both easy to insert and very hard to detect or prove.
- •
- •
Does E2EE protect metadata (who you talk to, when, how often)
- •
No — E2EE protects message content, but metadata is typically still visible to the service provider unless separately protected.
- •
- •