We’re launching Lyria 3.5 in Google Flow Music, with advances across musicality, lyrics, vocals, and creative control
deepmind.google·6d ago
AI Engineering
Hacker News·Jul 5·5 min read
Web-based cryptography is always snake oil
TL;DR
Web applications often claim to provide 'end-to-end' encryption, but these claims are fundamentally flawed due to the web's architecture. The inherent issue is that client-side code is distributed by the web server, making true end-to-end encryption impossible.
✦ Why It Matters
Engineers should critically assess web-based cryptographic claims and prioritize secure, client-controlled solutions.
Key Takeaways
- Evaluate the security claims of web applications critically.
- Understand the limitations of web-based cryptography.
- Prioritize client-controlled encryption solutions.
- Educate users about the risks of trusting web-based services.
Full Summary
Many web applications, such as file sharing services and password managers, advertise 'end-to-end' encryption, suggesting that user data is secure from server access. However, the web platform's architecture means that the client-side code, which handles encryption, is controlled by the server operator.
This creates a significant threat model inconsistency, as users must trust the server to implement encryption correctly. The article argues that this model is inherently flawed, leading to unreliable cryptographic claims.
Without a secure method to ensure that the client-side code is not tampered with, these services cannot provide the promised security. Consequently, users may be misled about the safety of their data, which can have serious implications for privacy and security.
Engineers and researchers should be aware of these limitations when designing or evaluating web-based cryptographic solutions.